1005636 - XPI install can be covered by a window.showmodaldialog

Status: RESOLVED WORKSFORME

(Core :: Security, defect)

Description

[Jordi Chancel]

Attachment: POC.html

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:29.0) Gecko/20100101 Firefox/29.0 (Beta/Release)
Build ID: 20140421221237

Steps to reproduce:

when you load localy a windows that lead to an XPI install and you load after a window.showmodaldialog that cover it you can install it with just press ENTER.

steps:
1 : click on the button into the poc
2 : PRESS ENTER DIRECTLY.


Actual results:

XPI is Installed


Expected results:

cover XPI install by window.showmodaldialog is wrong.

Comment 1

[Jordi Chancel]

TESTED ON MAC ONLY.

Comment 2

[Jordi Chancel]

Attachment: POC.zip

Comment 3

[Jordi Chancel]

this issue don't works on WINDOWS.

Comment 4

[Matt Wobensmith [:mwobensmith][:matt:]]

As Jordi says in the whiteboard, this only works locally on Mac, as far as we know.

Seems that keyboard input is not directed to the foremost spawned window, but to the XPI install dialog behind it.

Comment 5

[Jordi Chancel]

- I have reported a new bug more or less similar to this bug : https://bugzilla.mozilla.org/show_bug.cgi?id=1008652 but with this new vulnerability it's possible to make a spoofing remotely.

- Please View Bug1008652 .

Comment 7

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

I am going to close 1008652 as a dupe of this bug and merge the info, these are so similar in scope that there is no point in 2 bugs

Notes from Bug 1008652 of relevance
* youtube private video => https://www.youtube.com/watch?v=xGeF8d18oiQ&feature=youtu.be

Comment 8

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Attachment: POC (remote version).html

Comment 9

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Attachment: POC (local version).html

Comment 10

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

per https://wiki.mozilla.org/Security_Severity_Ratings 
> sec-low
> Minor security vulnerabilities such as leaks or spoofs of non-sensitive information. Missing best
> practice security controls 

I am rating this bug as a low

Comment 11

[Jordi Chancel]

I think it's not low , localy this attack can execute arbitrary code with just one click and press ENTER.

Comment 12

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

While that may be the case first you have to get the user to go to the arbitrary site, then get them to download the file then run it locally and then get them to follow the proper steps to be exploited. Given all that user interaction I think the rating of low is appropriate, however, as always others will weigh in. 

We'd also appreciate it if you would stop editing the fields of the bug after we do, this affects our workflow and bug handling and will only delay any necessary work we need to accomplish. We appreciate your comments and input and we do consider them when we make changes to ratings and other sections.

Comment 13

[Jordi Chancel]

- Sorry for trouble.

I have found a more critical (sg:moderate i think) attack using this bug. it's very similar to bug884488 in all point.

I think that the new appropriate severity is Moderate now.

I will make a private video and post the new testcase for show the real severity of this bug.

Can you reply quickly for say if i have reason or not please?

Thank you very much.

Comment 14

[Jordi Chancel]

Attachment: TESTCASE N°3.zip

New Testcase!

Comment 15

[Jordi Chancel]

(In reply to Jordi Chancel from comment #13)
> - Sorry for trouble.
> 
> I have found a more critical (sg:moderate i think) attack using this bug.
> it's very similar to bug884488 in all point.
> 
> I think that the new appropriate severity is Moderate now.
> 
> I will make a private video and post the new testcase for show the real
> severity of this bug.
> 
> Can you reply quickly for say if i have reason or not please?
> 
> Thank you very much.

Look this video : https://www.youtube.com/watch?v=7YVAuDe1Lkc&feature=youtu.be

Comment 16

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

It's still a local only attack on mac only, while the elements here look a bit more real you can still see the window controls and drop shading of the covering box. But the reality of this rating is that it's dependent on the first part mentioned in comment 12. You have to get the user to take a good number of steps before you can even start the attack and for that reason this rating should not change.

Comment 17

[Daniel Veditz [:dveditz]]

We know these dialogs need work, and we're going to be removing/changing them. Reporting variations based on known-to-be-broken UI isn't going to be severe enough to earn more bounties unless there's something novel.

Comment 19

[Jordi Chancel]

Attachment: TestCase n°4 ( local vuln - download this file ).html

I've sent a mail today about the severity of this testcase.

Comment 20

[:Gijs (he/him)]

bug 1374460 documents showModalDialog as having been disabled by default in 56 and code removed later on, so this is WFM.