1256134 - An update to prefs.js file through social engineering can be used to redirect users to malicious websites to download malware payload by changing the default homepage

Status: RESOLVED INVALID

(Firefox :: Untriaged, defect)

Description

[Ayushman Dutta]

Attachment: POC.py

User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36

Steps to reproduce:

Wrote a small script to change the homepage to a different site. Opened the browser and it redirected me to that site as usual without me giving a request to that page


Actual results:

The browser was redirected to the site which I overwrote


Expected results:

The pref.js file should not be able to be edited. It should only be accessible through the browser to edit and with proper permissions

Comment 1

[:Gijs (he/him)]

In order for the file to be writable by Firefox itself which is running with user-privileges, the user needs to have write access to that file. There is no way to make the file "not writable" by the user, but writable by Firefox when it's run by that user. As a result, I'm going to resolve this as invalid and mark it as non-security-sensitive.