[gateway] ServiceWorker could take control over gateway endpoints #4025

surma · 2017-06-30T15:19:49Z

Version information: 0.4.10-4679f80

Type: Bug

Severity: Low. Not currently a security issue, but could become one in the future.

Description:

Take a look at QmaEtDG87K69mVR7sc48DemHpj3LqxKaQfDw6qJr2AGbmZ:

<!doctype html>
<script>
  navigator.serviceWorker.register('/ipfs/QmRcqyy8yFsVhgErobYrTcF5PSQHC36TqpA19xnBkQpFcB');
</script>

The requested ServiceWorker file is the following:

self.oninstall = event => event.waitUntil(self.skipWaiting());
self.onactivate = event => event.waitUntil(self.clients.claim());
self.onfetch = event => event.respondWith(new Response('All my base are belong to us.'));

This currently does not work for only one reason: The Content-Type on the ServiceWorker file is
not application/javascript but text/plain. If it was set to application/javascript, I could
do the following:

Make someone to visit https://gateway.ipfs.io/ipfs/QmaEtDG87K69mVR7sc48DemHpj3LqxKaQfDw6qJr2AGbmZ
My ServiceWorker would be installed
All subsequent requests to anything that starts with https://ipfs.io/ipfs/ will return ‘All my base are belong to us.’. Even worse, since the introduction of Foreign-Fetch ServiceWorker, even websites using the CORS-enabled gateway.ipfs.io endpoint would receive the same response.

Currently, the Go FileServer implementation, which the gateway uses, does not sniff JavaScript to set a Content-Type: application/javascript header. If they ever change that, or IPFS exposes control over Content-Type, the gateway would become vulnerable to the attack above.

I think ServiceWorker are powerful and they should be allowed on IPFS. ServiceWorker are scoped to
the path where the ServiceWorker file is located. Most of the time it would be located at paths
like /ipfs/<HostID>/serviceworker.js, and therefore be in control of all requests to /ipfs/<HostID>/... which is entirely reasonable.

There’s currently no way to completely disable ServiceWorker for a domain or a path, so I created an issue on the ServiceWorker spec. For the time being, my suggestion is to sett the header Service-Worker-Allowed: /_jail on all requests that match ^/ip[fn]s/[^/]+$ on the gatway.

The text was updated successfully, but these errors were encountered:

whyrusleeping · 2017-06-30T18:51:42Z

Hah, very interesting. Thanks for the detective work here :)

We will definitely keep this in mind when moving forward with service worker addons

daviddias · 2017-07-03T11:54:04Z

Thanks for converting the report into this issue and for opening w3c/ServiceWorker#1165 as a proposal!

whyrusleeping · 2017-08-31T18:08:12Z

Putting this on the 0.4.12 milestone so we give it more attention. I know we want to start doing more with service workers and content types, so its important to keep this in mind and follow up.

surma · 2017-08-31T18:47:20Z

Happy to help review any idea y’all have in the general area of Service Worker :)

Kubuxu · 2017-11-06T19:01:50Z

Solution would be to block requests to /ipfs/Qm...AAA with Service-Worker: script header.
Requests to /ipfs/Qm...AAA/xxxx.js should be allowed.

See w3c/ServiceWorker#1165 (comment)

surma · 2017-11-06T19:05:58Z

I like that solution.

olizilla · 2018-02-09T10:57:59Z

Just for clarification for anyone who is new to Service Workers (me), I was initially confused as to why SWs path scope rules wouldn't solve this, but I see now that it doesn't

If you register a SW from:

/ipfs/QmHash/sw.js

then the scopeUrl is /ipfs/QmHash/ and your SW can only manipulate requests for resources below that hash, which is good and proper. But if as in the example you register a SW directly from:

/ipfs/QmHash

and the gateway starts to serve files like that with the correct js mime-type where appropriate, then the browser will have loaded a js file called QmRcqyy8yFsVhgErobYrTcF5PSQHC36TqpA19xnBkQpFcB from the path /ipfs.

In ServiceWorker terms, the scopeUrl ends up being /ipfs/, and that means all other requests for files served from the gateway end up under the control of a potentially malicious ServiceWorkers control.

Of note, path based scopes for service workers were, at least partly, introduced to allow usecases where a service hosts content from multiple users in sibling directories, see: w3c/ServiceWorker#468

Also of note there is an active issue discussing the service worker path scope trailing slash issue and sub origins here: w3c/ServiceWorker#1272

lidel · 2018-08-07T21:59:55Z

Just for the record, another vector for this could be future support for returning content-type stored in "Extended Attributes" of ipld/legacy-unixfs-v2#11

Introduces hardening proposed in: ipfs/kubo#4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>

Introduces hardening proposed in: #4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>

Introduces hardening proposed in: ipfs#4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>

Introduces hardening proposed in: #4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>

Introduces hardening proposed in: ipfs/kubo#4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>

Introduces hardening proposed in: ipfs#4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>

Introduces hardening proposed in: ipfs/kubo#4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org> This commit was moved from ipfs/kubo@115b2ba

Introduces hardening proposed in: ipfs/kubo#4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org> This commit was moved from ipfs/kubo@455e498

Kubuxu added kind/bug A bug in existing code (including security flaws) topic/gateway Topic gateway topic/security Topic security labels Jun 30, 2017

whyrusleeping added this to the Ipfs 0.4.12 milestone Aug 31, 2017

Kubuxu modified the milestones: Ipfs 0.4.12, go-ipfs 0.4.13 Nov 6, 2017

olizilla mentioned this issue Aug 2, 2018

fix: fix content-type detection by doing a fall-back based on the ext… ipfs/js-ipfs#1482

Merged

lidel mentioned this issue Aug 6, 2018

Write up the security + privacy implications of running IPFS Service Worker ipfs/in-web-browsers#57

Open

Stebalien mentioned this issue Aug 20, 2018

Set filename in Content-Disposition if filename=x is passed in URI query #4177

Merged

Stebalien mentioned this issue Sep 25, 2018

better content-type for wasm #5520

Closed

momack2 added this to Inbox in ipfs/go-ipfs May 9, 2019

olizilla mentioned this issue Nov 26, 2019

Proposal: manifest file for the IPFS gateway #6214

Closed

lidel added a commit to ipfs/js-ipfs that referenced this issue Dec 17, 2019

fix: limit SW registration to content root

109549f

Introduces hardening proposed in: ipfs/kubo#4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>

This was referenced Dec 17, 2019

fix: limit SW registration to content root ipfs/js-ipfs#2682

Merged

fix: limit SW registration to content root #6801

Merged

Stebalien closed this as completed in #6801 Dec 17, 2019

Stebalien pushed a commit that referenced this issue Dec 17, 2019

fix: limit SW registration to content root

115b2ba

Introduces hardening proposed in: #4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>

Stebalien pushed a commit that referenced this issue Dec 17, 2019

fix: limit SW registration to content root

ae0e31d

Introduces hardening proposed in: #4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>

pontiyaraja pushed a commit to pontiyaraja/go-ipfs that referenced this issue Dec 27, 2019

fix: limit SW registration to content root

dbf8e4a

Introduces hardening proposed in: ipfs#4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>

Stebalien pushed a commit that referenced this issue Jan 17, 2020

fix: limit SW registration to content root

06b079b

Introduces hardening proposed in: #4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>

Stebalien pushed a commit that referenced this issue Jan 17, 2020

fix: limit SW registration to content root

7b96d93

Introduces hardening proposed in: #4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>

Stebalien pushed a commit that referenced this issue Jan 17, 2020

fix: limit SW registration to content root

720fd71

Introduces hardening proposed in: #4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>

Stebalien pushed a commit that referenced this issue Jan 17, 2020

fix: limit SW registration to content root

455e498

Introduces hardening proposed in: #4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>

lidel added a commit to ipfs/js-ipfs that referenced this issue Feb 1, 2020

fix: limit SW registration to content root

dd93dd7

Introduces hardening proposed in: ipfs/kubo#4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>

alanshaw pushed a commit to ipfs/js-ipfs that referenced this issue Feb 3, 2020

fix: limit SW registration to content root

fa82593

Introduces hardening proposed in: ipfs/kubo#4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>

alanshaw pushed a commit to ipfs/js-ipfs that referenced this issue Feb 3, 2020

fix: limit SW registration to content root (#2682)

feba661

Introduces hardening proposed in: ipfs/kubo#4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>

ralendor pushed a commit to ralendor/go-ipfs that referenced this issue Jun 6, 2020

fix: limit SW registration to content root

52ed2f2

Introduces hardening proposed in: ipfs#4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>

ralendor pushed a commit to ralendor/go-ipfs that referenced this issue Jun 6, 2020

fix: limit SW registration to content root

42e2c62

Introduces hardening proposed in: ipfs#4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>

ralendor pushed a commit to ralendor/go-ipfs that referenced this issue Jun 6, 2020

fix: limit SW registration to content root

37dbff4

Introduces hardening proposed in: ipfs#4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>

ralendor pushed a commit to ralendor/go-ipfs that referenced this issue Jun 8, 2020

fix: limit SW registration to content root

84a1f05

Introduces hardening proposed in: ipfs#4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>

ralendor pushed a commit to ralendor/go-ipfs that referenced this issue Jun 8, 2020

fix: limit SW registration to content root

d534161

Introduces hardening proposed in: ipfs#4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>

ralendor pushed a commit to ralendor/go-ipfs that referenced this issue Jun 8, 2020

fix: limit SW registration to content root

f4f216e

Introduces hardening proposed in: ipfs#4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>

ralendor pushed a commit to ralendor/go-ipfs that referenced this issue Jun 8, 2020

fix: limit SW registration to content root

d5f7993

Introduces hardening proposed in: ipfs#4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>

ralendor pushed a commit to ralendor/go-ipfs that referenced this issue Jun 8, 2020

fix: limit SW registration to content root

535a836

Introduces hardening proposed in: ipfs#4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>

ralendor pushed a commit to ralendor/go-ipfs that referenced this issue Jun 8, 2020

fix: limit SW registration to content root

e52e4ef

Introduces hardening proposed in: ipfs#4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>

mar1n3r0 mentioned this issue Feb 2, 2022

Self-contained app running on IPFS maxence-charriere/go-app#691

Closed

This was referenced Jun 23, 2022

Add HTTP Gateway Specs ipfs/specs#283

Merged

Test Service-Worker: script behavior ipfs/public-gateway-checker#260

Open

hacdias pushed a commit to ipfs/boxo that referenced this issue Jan 27, 2023

fix: limit SW registration to content root

2e46fb7

Introduces hardening proposed in: ipfs/kubo#4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org> This commit was moved from ipfs/kubo@115b2ba

hacdias pushed a commit to ipfs/boxo that referenced this issue Jan 27, 2023

fix: limit SW registration to content root

bb228d1

Introduces hardening proposed in: ipfs/kubo#4025 (comment) License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org> This commit was moved from ipfs/kubo@455e498

lidel mentioned this issue Mar 6, 2023

Leverage Service Worker and WebTransport on Public Gateways ipfs/in-web-browsers#207

Open

lidel mentioned this issue Aug 10, 2023

Add test for Service-Worker registration scope ipfs/gateway-conformance#138

Open

lidel mentioned this issue Oct 29, 2023

feat(gw): Ipfs-Gateway-Mode: path|trustless ipfs/boxo#495

Closed

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[gateway] ServiceWorker could take control over gateway endpoints #4025

[gateway] ServiceWorker could take control over gateway endpoints #4025

surma commented Jun 30, 2017

whyrusleeping commented Jun 30, 2017

daviddias commented Jul 3, 2017

whyrusleeping commented Aug 31, 2017

surma commented Aug 31, 2017

Kubuxu commented Nov 6, 2017

surma commented Nov 6, 2017

olizilla commented Feb 9, 2018 •

edited

lidel commented Aug 7, 2018

[gateway] ServiceWorker could take control over gateway endpoints #4025

[gateway] ServiceWorker could take control over gateway endpoints #4025

Comments

surma commented Jun 30, 2017

Version information: 0.4.10-4679f80

Type: Bug

Severity: Low. Not currently a security issue, but could become one in the future.

Description:

whyrusleeping commented Jun 30, 2017

daviddias commented Jul 3, 2017

whyrusleeping commented Aug 31, 2017

surma commented Aug 31, 2017

Kubuxu commented Nov 6, 2017

surma commented Nov 6, 2017

olizilla commented Feb 9, 2018 • edited

lidel commented Aug 7, 2018

olizilla commented Feb 9, 2018 •

edited