1009169 - Invisible mouse cursor when leaving bounds of SWF over DIV and via context menu

Status: RESOLVED INCOMPLETE

(Core Graveyard :: Plug-ins, defect)

Description

[Jordi Chancel]

Attachment: TESTCASE1.zip

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:32.0) Gecko/20100101 Firefox/32.0 (Beta/Release)
Build ID: 20140512030202

Steps to reproduce:

This vulnerability is more or less similar to bug995603 but it works on the fixed version (firefox nightly 32).

steps:
-1 go with the cursor on the flash object
-2 exit the flash object slowly by the up

(I think a better way for make the cursor invisible is possible , i will work for that.)

Results:
Cursor can be sometime totally invisible


Actual results:

you can make a cursor-jacking/click-jacking/spoofing attacks when the cursor in totally invisible.


Expected results:

when you exit the flash object by the up slowly the cursor can be totally invisible.

Comment 1

[Jordi Chancel]

youtube private video => https://www.youtube.com/watch?v=52A0Ov3KBuE&feature=youtu.be

Comment 2

[Matt Wobensmith [:mwobensmith][:matt:]]

It is pretty difficult to reproduce, but eventually I can see it. As is, hard to exploit.

Comment 3

[Jordi Chancel]

I will works on it for make this more easy to exploit.

Comment 4

[Jordi Chancel]

I have found a way for make sure than the cursor will be invisible but it's needed to right click and go to the context menu...
do you want view this?

Comment 5

[Jordi Chancel]

video with right click => https://www.youtube.com/watch?v=O_gS9S_kQRI&feature=youtu.be

Comment 6

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

So I can repro this as well, I noticed that the "phantom" pointer has an upper bound of the bottom of the flash object (but that may be because I am hitting the upper limit of the OS windows with the actual invisible pointer) and that if I re-navigate over the flash object my real pointer re-appears.

Is this a regression or a case that just got missed instead of fixed?

Comment 7

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

in the context menu object case the mouse can be restored by the "esc" key

Comment 8

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

I also got the pointer back by navigating to the edge of my screen in the context menu case

Comment 9

[Jordi Chancel]

I have found a new way for make the cursor totally invisible. I use WebRTC and when i move the mouse on the flash object , the webRTC prompt will cover the flash object and the cursor will be totally invisible!
I will upload the new testcase now.

Comment 10

[Jordi Chancel]

Attachment: TESTCASE n°2 using webRTC.zip

This TESTCASE use WebRTC , when you move the mouse on the flash object , the WebRTC prompt will cover it and the cursor will be totally invisible.

Comment 11

[Jordi Chancel]

Attachment: TESTCASE N°3.zip

This TESTCASE is an update of TESTCASE 2 and is more exploitable.
Please don't use testcase2 and use this TESTCASE N°3 .

Comment 12

[Jordi Chancel]

Attachment: TESTCASE N°4.zip

This TESTCASE N°4 is an update of testcase N°3 , please use this testcase and not the testcase N°3.

Move your mouse on the flash object, wait 2s and the WebRTC Prompt will cover the flash object and the cursor will be totally invisible.

Comment 13

[Jordi Chancel]

Attachment: EXAMPLE WITH WEBRTC.mp4

An Example with WebRTC prompt (more critical).

Comment 14

[Jordi Chancel]

Youtube private Video with WebRTC prompt => https://www.youtube.com/watch?v=DYSiHhbMqWs&feature=youtu.be

Comment 15

[Matt Wobensmith [:mwobensmith][:matt:]]

The original bug here and the new bug in comment 12 are very different. The first one is an edge case related to bug 995603 that should be fixed, but is not as serious. The second one involves spawning the WebRTC dialog while the Flash movie has hidden the cursor. 

I believe the first bug - the original bug - is a pretty low rating. However, the second one is bad. Looks trivial to clickjack the WebRTC permission dialog. I strongly feel that we need to always force the mouse cursor to be displayed whenever that dialog is shown.

Comment 16

[Matt Wobensmith [:mwobensmith][:matt:]]

I am renaming this bug and splitting off the WebRTC issue into its own issue - bug 1009540. Please move conversation of that issue to that page.

This bug will remain open to deal with the edge cases of slowly leaving the SWF bounds overlapped by a DIV (bug 995603) and the context menu. 

These bugs should be rated separately.

Comment 17

[Jordi Chancel]

- "Invisible mouse cursor when leaving bounds of SWF over DIV" : I would to say that it's not needed to leaving bounds of SWF over DIV. You can just go out bounds (up and not down) of SWF and just go on the <body>, or others objects (as you want) But not necessarily DIV.

Comment 18

[Jordi Chancel]

- And i would to say that it is not necessary too to go out slowly but sometime with a normal speed the mouse can be totally invisible as well.

Comment 19

[Jordi Chancel]

(In reply to Jordi Chancel from comment #17)
> - "Invisible mouse cursor when leaving bounds of SWF over DIV" : I would to
> say that it's not needed to leaving bounds of SWF over DIV. You can just go
> out bounds (up and not down) of SWF and just go on the <body>, or others
> objects (as you want) But not necessarily DIV.

- Can you fixed the title of this bug please?

Comment 20

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

We believe the title of the bug is sufficiently accurate and that the comments provide any further necessary information.

Comment 21

[Al Billings [:abillings - ex-MoCo]]

Since this issue fixes (as much as anything) bug 1009540 as well this, is there a way to get this addressed? Is this something you could work on, Gavin?

Comment 22

[:Gavin Sharp [email: [e-mail]]]

No. Sounds like some strange issue with the Flash plugin. Maybe Benjamin has some ideas.

Comment 23

[Benjamin Smedberg]

ISTR another bug like this one (mac-specific), but I can't remember it. Flash is setting the mouse cursor and isn't resetting it properly. smichaud, do you remember a bug like this?

In either case, can we do something simple like force reset/show the mouse cursor when the mouse leaves a plugin?

Comment 24

[Steven Michaud [:smichaud] (Retired)]

It will take me a while to look into this.

> In either case, can we do something simple like force reset/show the
> mouse cursor when the mouse leaves a plugin?

I think we already do.	It's possible, though, that there are still
some cases where a mouse-exit event isn't sent where it's supposed to
be.

Comment 25

[Steven Michaud [:smichaud] (Retired)]

> ISTR another bug like this one (mac-specific)

You're probably thinking of bug 995603.

Among other things, I need to check that the patch for bug 1092630 didn't regress the fix for that bug.

Comment 26

[Steven Michaud [:smichaud] (Retired)]

From re-reading the comments, I understand this bug is very difficult to reproduce.  And given the number of testcases, it's not clear we don't have more than one bug here.

It may be better to concentrate on bug 1009540, which (apparently) effects all platforms and seems a bit more definite.

I will double-check that the fix for bug 995603 hasn't been regressed by the patch for bug 1092630.  But beyond that there's probably nothing we can do here.