AOH :: HP Unsorted S :: TB11502.HTM

Security on AIR: Local file access through JavaScript
Security on AIR: Local file access through JavaScript
Security on AIR: Local file access through JavaScript


It's just a very first look to AIR (Adobes Integrated Runtime) and  
its possibilities to process HTML/JS. AIR is beta by now, so Adobe  
may change things in the final release.

## What is AIR?
Quote from Adobe: "Adobe Integrated Runtime (AIR) is a cross- 
operating system runtime that allows you to leverage your existing  
web development skills (Flash, Flex, HTML, JavaScript, Ajax) to build  
and deploy Rich Internet Applications (RIAs) to the desktop."

## Some security related informations on AIR:
- The installer throws a warning about it's ability for unrestricted  
system access (so it's not a real surprise what AIR apps are capable of)
- AIR uses WebKit as renderer on both supported platforms, Windows  
and MacOS
- AIR introduces some JavaScript functions to access file systems and  
remote services, file SQL queries and open sockets
- SWF files in the AIR application sandbox can cross-script any SWF  
file from any domain
- Remote SWF files can only read files inside the security sandbox
- SWF/ActionScript objects can access DOM and JavaScript (and vice  
versa I guess)
- External JavaScript sources can be included and executed

## File access
In general every file on local file system can be accessed by AIR  
apps. This includes reading, writing, appending or deletion as well  
as testing for file and directory existence. Another interesting  
feature is the possibility to overwrite calling files inside compiled  
AIR application during runtime.

## Example (only tested on OSX so far)
For this to work in a real world scenario a service used by an AIR  
app must be vulnerable to a persistant XSS (or another typical  
vulnerability), and the app needs to call data in a way that payloads  
gets rendered and executed.

This basic example consists of 4 files:
- AIR application descriptor file: App.xml
- Calling HTML file inside the AIR app package: caller.html
- Malicious external JavaScript: overwrite.js
- A file which just contains aliases for AIR runtime: AIRAliases.js  
(part of AIR SDK)

# App.xml

appId="air.poc.overwrite" version="0.1">
AIR Overwrite

# caller.html
# For lazyness reasons the JS is included straight away
# But it also works if exploited and included during runtime

AIR Overwrite

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH
We do not send spam. If you have received spam bearing an email address, please forward it with full headers to