I read this article, and the whitepaper by security researcher Oren Hafif which mentions the following salient points:

RFD, like many other Web attacks, begins by sending a malicious link to a victim. But unlike other attacks, RFD ends outside of the browser context:

  1. The user follows a malicious link to a trusted web site.
  2. An executable file is downloaded and saved on the user’s machine. All security indicators show that the file was “hosted” on the trusted web site.
  3. The user executes the file which contains shell commands that gain complete control over the computer.

An example of a malicious URL looks like this:


This looks similar to the recent shellshock bug, except that the attack is directed at the client instead of the server. My questions are:

  • Is Google hosting a ChromeSetup.bat file under a directory /s; on its server?
  • Which OSes are vulnerable? Is this attack specific to a particular version of Windows OS?
  • How can clients protect themselves if a website allows its user to place malicious URLs in the src attribute of an <img> tag?

1 Answer 1

  1. Google is not hosting ChromeSetup.bat. A requirement for this attack is that a website needs to have an endpoint with a less common Content-Type and preferably a misconfigured Content-Disposition header (namely: no 'filename' attribute). These two headers will cause the browser to download the response as a file, instead of rendering it.

In the URL you provide that endpoint is '/s' which provides autocomplete suggestions as JSON, with a content type of application/json. Older versions of IE will prompt a download just based on the content type, newer versions and Chrome require that incomplete content-disposition header for this attack to work.

Another requirement is that this endpoint must reflect some user input from the querystring ( post or cookie data will obviously work aswell but wouldn't be as effective for the attacker). This will provide the malicious content of the file that is downloaded.

In the URL you provided this will be the value of the querystring parameter.

As no filename is provided for the download, the browsers tries to pick one. Because the Google website allowed loose urls through url parameters (the ;/ChromeSetup.bat; part), the browser picked a cleaned up version of that (namely ChromeSetup.bat) as the filename to present to the user. The webapplication ignores this input, but the browser does use it.

  1. Any browser on any OS might respond in this way. Chrome will download the response with the forged filename, that will also work on OSX.

An additional weakness exists in Windows that doesn't warn the user properly when "setup" occurs in the filename. Windows will also directly run a .bat file if you click it. Osx and Linux won't run this file as the attacker would most likely be unable to provide a full shellscript with the hashbang notation. Even then, it doesn't have the executable bit set, so it wouldn't be run directly.

  1. The user still has to activate/accept the download, so just driving by with an won't cause immediate "infection". A client (browser) should provide proper warnings for executable files instead of just running them. The user should know better than to run random .bat files, but that's the strength of this attack: the "file" is served from Google.com, so it should be safe right? The most important party here is the vulnerable website: the website shouldn't allow a user to provide a custom path, should provide proper headers to prevent this and should reconsider reflecting user input.
  • For 1) Can you elaborate on what you mean by the value of s was reflected? I don't understand the part where /s; works while /a; does not. How does the request trick the server to set the content-type and disposition headers when there are no files to send over? Commented Nov 1, 2014 at 4:16
  • For 2) Can you state clearly which OSes are affected by the vulnerability? Are all versions of windows affected? Are all versions of Linux and OSX not affected? Commented Nov 1, 2014 at 4:18
  • I've edited my response to clear up the requirements for this attack. All browsers will probably download the file but AFAICS only Windows will actually run a file with 1 click.
    – NSSec
    Commented Nov 1, 2014 at 7:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .