1202112 - A top-level includeSubdomains directive does not enforce STS for subdomains if there is an intermediate superdomain without the includeSubdomains directive

Status: RESOLVED DUPLICATE of bug 1870262

(Core :: Security: PSM, defect, P3)

Description

[Sami Jaktholm]

Attachment: str-console-commands.js

Example setup:
1. example.com sends Strict Transport Security header with the includeSubdomains directive.
2. subdomain.example.com sends Strict Transport Security header without the includeSubdomains directive.
3. sub.subdomain.example.com does not send Strict Transport Security header.

STR:
1. Make a request to https://example.com >> The HSTS status is saved.
2. Make a request to https://subdomain.example.com >> The HSTS status is saved.
3. Make a request to http://sub.subdomain.example.com

Actual results: The request is sent over HTTP.
Expected results: The request is sent over HTTPS as the superdomain example.com sent an STS header with the includeSubdomains directive.

The RFC 6797 states (section 8.3 [1]) that if __any__ superdomain of a domain has includeSubdomains directive the given domain should be considered secure.

I don't have a live demo for this but I attached a script (str-console-commands.js) that uses SiteSecurityService to set the HSTS status and query the security state of a site afterwards. It can be opened in a Scratchpad that uses the browser environment or copy-pasted directly to the Browser Console.

The problem occurs at [2] where the includeSubdomains directive of the first superdomain with HSTS status determines the STS status for the inspected host even if a higher level superdomain could contain the includeSubdomains directive making the host secure.

[1] http://tools.ietf.org/html/rfc6797#section-8.3
[2] https://dxr.mozilla.org/mozilla-central/rev/e816a7a854a333bda1447ab6c5b633233f322669/security/manager/ssl/nsSiteSecurityService.cpp#1023

Comment 1

[Daniel Veditz [:dveditz]]

This is a spec compliance issue more than a vulnerability that can be used to attack users. Better to keep the bug unhidden so server operators (the only ones who could do something about it) can learn about the problem.