1278053 - Visit site anyway allows to load any domains if same invalid certificate is used.

Status: RESOLVED FIXED

(Firefox for iOS :: Browser, defect)

Description

[Muneaki Nishimura]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.63 Safari/537.36

Steps to reproduce:

Following two web sites use same *invalid* certificate that CN is Akamai.
https://us.playstation.com/
https://www.forbes.com/

Opens https://us.playstation.com/ and taps "Visit site anyway" in certificate error page.


Actual results:

Firefox for iOS allows to load not only us.playstation.com but also https://www.forbes.com/ .

Suppose an attacker does MITM for all web https origins and if same flaud certificate is used, Firefox shows warning only for the first accessed domain but any successive web sites are automatically allowed to load.

This reason is that ErrorPageHelper registers permitted certificate to the certStore without accepted domain name.
https://github.com/mozilla/firefox-ios/blob/78df359fd64aa7fc98bb2e1e7f65863c434fd3bb/Client/Frontend/Browser/ErrorPageHelper.swift#L294



Expected results:

"Visit site anyway" should be applied to the domain user permitted.

Comment 1

[Muneaki Nishimura]

Note that Safari and Chrome for iOS correctly blocks each invalid https host even if same certificate is used.

Comment 2

[Matt Wobensmith [:mwobensmith][:matt:]]

Brian, looks like your code. Can you take a look?

Comment 3

[Brian Nicholson (:bnicholson)]

Good catch. Yes, I'll fix this right away.

Comment 4

[Brian Nicholson (:bnicholson)]

Attachment: Link to Github pull-request: https://github.com/mozilla/firefox-ios/pull/1905

Comment 5

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

Comment on attachment 8761764 [details] [review]
Link to Github pull-request: https://github.com/mozilla/firefox-ios/pull/1905

Looks good. Do you think this we can create a unit test for this? Or maybe just for the lookup logic?

Comment 6

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

Marked as needsuplift, but I don't know if sleroux will see this bug since he has no secure bug privs? I'll cc him anyway.

Comment 7

[Brian Nicholson (:bnicholson)]

(In reply to Stefan Arentz [:st3fan] from comment #5)
> Comment on attachment 8761764 [details] [review]
> Link to Github pull-request: https://github.com/mozilla/firefox-ios/pull/1905
> 
> Looks good. Do you think this we can create a unit test for this? Or maybe
> just for the lookup logic?

Thanks for the reminder -- we already have CertTests, so I updated it with origin support.

Comment 8

[Brian Nicholson (:bnicholson)]

master: https://github.com/mozilla/firefox-ios/commit/35c48006eddfa1f626801c1a6ac530b3e3bd51f5
v5.x: 1711054