[tor-bugs] #18101 [Tor Browser]: IP leak from Windows UI dialog with URI

Tor Bug Tracker & Wiki blackhole at torproject.org
Tue Jan 19 17:30:05 UTC 2016

#18101: IP leak from Windows UI dialog with URI
     Reporter:  uileak       |      Owner:  tbb-team
         Type:  defect       |     Status:  new
     Priority:  Medium       |  Milestone:
    Component:  Tor Browser  |    Version:  Tor: unspecified
     Severity:  Normal       |   Keywords:  IP leak
Actual Points:               |  Parent ID:
       Points:               |    Sponsor:
 It is possible for the client IP to leak from the browser and onto the
 network via the Windows API when prompted with Windows dialog box to
 select files.

 Not entirely sure if this is a bug, but should at least be documented.

 Steps to reproduce:
 1. Visit a website that provides an upload box.
 2. Instead of selecting a file, paste a URI as a file name.
 3. The IP is leaked.

 This may potentially work with Ctrl+O (Open File) and Ctrl+S (Save Page

 Tested on Windows 7 and verified with Wireshark.

Ticket URL: <https://trac.torproject.org/projects/tor/ticket/18101>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online

More information about the tor-bugs mailing list