Vulnerability Note VU#715737

The jar: protocol is designed to extract content from ZIP compressed files. Mozilla-based browsers include support for jar: URIs that are of the form jar:[url]![/path/to/file.ext]. The compressed file does not need to have a .zip extension.

From the GNUCITIZEN blog:

jar: content run within the scope/origin of the secondary URL. Therefore, a URL like this: jar:https:// example.com/test.jar!/t.htm, will render a page which executes within the origin of https://example.com.

This vulnerability may allow an attacker to execute cross-site scripting attacks on sites that allow users to upload pictures, archives, or other files.

This vulnerability is addressed in Mozilla Firefox 2.0.0.10: From MFSA 2007-37:

Support for the jar: URI scheme has been restricted to files served with a Content-Type header of application/java-archive or application/x-jar. Web applications that require signed pages must make sure their .jar archives are served with this Content-Type. Sites that allow users to upload binary files should make sure they do not allow these files to have one of these two MIME types.

Workarounds for network administrators and users

• NoScript version 1.1.7.8 and later may prevent this vulnerability from being exploited.

• Blocking URIs that contain jar: using a reverse proxy or application firewall could prevent an attacker from uploading content that could exploit website visitors.
• Website owners who accept user supplied content may wish to serve these files from "safe" domains, such as numbered IP addresses or sub-level domains that can not access sensitive information.