1145788 - Broken auth and session management in hello.firefox.com

Status: RESOLVED INVALID

(Hello (Loop) :: General, defect)

Description

[Ranjan]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0
Build ID: 20140715214327

Steps to reproduce:

Suppose there are 3 people here , V (victim) , A1(Attacker-1), A2(Attacker-2) !

1)-Now victim V registers himself on hello.firefox.com, and starts a new conversation.
2)-Now he invites Attacker (A1) and sends him a link on his email id say [e-mail]
3)-Now what A1 will do is not to use that link and further send it to A2 (Attacker-2) and A2 will go to that link and and accepts the invitation.
4)-Now the conversation is between the V and A2, even that link is never sent to any A2.
5)-Even if A2 leaves the conversation he can pass on this link to any other Attacker.


Actual results:

Actual results are that teven A2 was not invites at all , still he can have a conversation with V.


Expected results:

The token which comes in the form https://hello.firefox.com/[token] should be validate only with the email address to which the invitation is sent , e.g if A sends the request token to B then only B should be able to access that token (because the token should be linked with the email address)

Comment 1

[:Gavin Sharp [email: [e-mail]]]

This isn't a security problem, it's an intended aspect of the rooms design. The "Victim" in your scenario shouldn't be sending a room URL to an "Attacker", and should have the expectation that the room link can be shared (indeed sharing links is meant to be easy).