1272068 - content spoofing on location.services.mozilla.com

Status: RESOLVED FIXED

(Location :: General, defect, P2)

Description

[Muhammad Amr Nasef]

Attachment: Untitled.png

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.94 Safari/537.36

Steps to reproduce:

Go to this website : https://location.services.mozilla.com//For%20more%20information%20you%20could%20log%20in%20to%20our%20website%20www.evil.com


Actual results:

The user will think www.evil.com is from mozilla and this website could contain many things like malware or a fake website that the user will enter his email and password thinking it's the website which is vulnerable 


Expected results:

The victim computer will be hacker or his account on mozilla website.

Comment 1

[Simon Bennetts [:psiinon]]

Looks like this got lost as it was not raised as part of the bug bounty program :/
I'll try to find the right people to look at it...

Note that this is a core site in the bug bounty program.

Comment 2

[Vivek Panday]

so how many time to take to know that this issue is valid or not

Comment 3

[Simon Bennetts [:psiinon]]

This is a valid issue.

Comment 4

[Vivek Panday]

this issue for hall of fame or payout

Comment 5

[Simon Bennetts [:psiinon]]

Potentially yes, thats what the "sec-bounty?" means.
However it would apply to the initial reporter.

Comment 6

[Vivek Panday]

so my this report is for any hall of fame or bounty

Comment 7

[John Whitlock [:jwhitlock]]

This is application behavior, not infrastructure, so I'm moving it to the application bugs. Because it is sec-low and a 4-year-old bug, I'm setting priority as P2. I hope to ship a fix in 30 days.

This issue reflects the behavior of the default 404 view in Pyramid. The production behavior for an unknown URL is to set the error message to the URL path. This becomes the detail in the HTTPException base class, which is then injected into the body_template_obj template when rendering.

The solution is to implement our own not found view that doesn't repeat the request path.

Comment 8

[John Whitlock [:jwhitlock]]

Unassigning myself. I was hoping to get to this after some other (boring) work, but I haven't gotten to it, and this may be a good task for a new team member.

Comment 9

[Dustin J. Mitchell [:dustin] (he/him)]

https://github.com/mozilla/ichnaea/pull/1315

Comment 10

[John Whitlock [:jwhitlock]]

Merged, fixed in stage:

https://location.stage.mozaws.net//For%20more%20information%20you%20could%20log%20in%20to%20our%20website%20www.evil.com

This now returns only <h1>404 Not Found</h1>.

We'll close when it is in prod later this week.

Comment 11

[John Whitlock [:jwhitlock]]

This has been deployed to prod. The original URL now returns the text "404 Not Found", and no longer suggests to log in to www.evil.com.

https://location.services.mozilla.com//For%20more%20information%20you%20could%20log%20in%20to%20our%20website%20www.evil.com

Comment 12

[Vivek Panday]

is there any hall of fame after resloved this issue

Comment 13

[Jonathan Claudius [:claudijd] (use NEEDINFO)]

(In reply to Vivek Panday from comment #12)

is there any hall of fame after resloved this issue

We assess the issue as a sec low, there really isn't much security impact here.