A gaping security hole in a popular Firefox browser extension could allow malicious hackers to hijack files from a users hard drive, developers warned Tuesday.
The vulnerability was flagged in Greasemonkey, the Firefox add-on that allows users to load custom scripts that modify Web sites on the fly.
The flaw is so serious that developers are warning users to completely uninstall Greasemonkey versions prior to 0.3.5.
Mark Pilgrim, an XML coder who helped to evangelize the extension with the free “Dive into Greasemonkey” e-book, has published working exploits to highlight the severity of the flaw.
In a series of posts to the Greasemonkey mailing list, Pilgrim warned that the published exploits are “much, much worse” than first imagined, noting that a successful attacker could hijack any world-readable file from a vulnerable computer.
“An attacker doesnt even need to know the exact filename,” he said, noting that a certain exploit would return a parseable directory listing.
“In other words, running a Greasemonkey script on a site can expose the contents of every file on your local hard drive to that site,” Pilgrim said.
He added that certain Greasemonkey scripts can be exploited to expose the contents of every file on a users local hard drive to every site that user visits, and that an attacker “can quietly send this information anywhere in the world.”
Greasemonkey users are strongly advised to uninstall the extension completely or downgrade to Greasemonkey 0.3.5, which is described as a “neutered” version of Greasemonkey.
“I have heard no reports of this flaw being exploited, but now that its public knowledge it isnt safe to continue using any version of Greasemonkey other than 0.3.5. Please either upgrade to 0.3.5 or disable Greasemonkey until I can get a fix finished,” Pilgrim said.
“At this point, I dont trust having it on my computer at all. I would think that whoever is in charge of addons.mozilla.org should immediately remove the Greasemonkey XPI and post a large warning in its place advising people to uninstall it,” he added.
