1306696 - (CVE-2016-9065) Location bar spoofing Entering Fullscreen and lock exit fullscreen mode

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Raphael]

Attachment: 4.png

User Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36

Steps to reproduce:

User Agent: Mozilla 49
OS/ Android 4.4 kitkat

Steps to reproduce:

When you enable full screen mode, the user has the browser address bar disappears when the user goes to another site the option to return to the normal display mode does not work to exit full-screen mode, the user is forced to restart the browser.


Actual results:

Steps
1.Go to the testcase uploaded http://unix.testvt.testforhost.com/poc1.html
2. Touch the web page "click here" ( the fullscreen mode is activated )
3 Try to go out of the fullscreen mode by pressing the back button on your Android device
4 Try to go up in the web page for try to view the location bar

Actual results:

Each time that you touch the web page , the fullscreen mode is activated and leads to an URL and SSL spoofing vulnerability with a fake location bar.
An attacker could also depict you the address bar  the browser.




Expected results:

Expected results:

The fullscreen mode should be activated with the possibility to forbid this action on the webpage concerned.

----------
Sorry but I have a bad English

Comment 1

[Raphael]

Attachment: poc1.html

Comment 2

[Kevin Brosnan [Ex-Mozilla]]

This seems familiar, we may already have a bug on this. Maybe one of Jordi's bugs? The behavior changed in bug 1180295 though the old behavior was not much better. Seems similar to bug 928023. 

I am not sure that this is a security bug, at best it is a DOS. It leaves the browser in an unusable broken state. Workaround is to swipe close Firefox and let Firefox session restore recover the browser state.

Comment 3

[Raphael]

Yes I agree with you that this problem was ranih versions of Firefox, but as you can see, there is now an error. I believe that this is the vulnerability of small, but with a different use of possible spoofing address bar or as you said Dos in the form of advertising (Popunder & clickunder)

Comment 4

[Kartikaya Gupta (email:[e-mail])]

Possible dupe of bug 1173831?

Comment 5

[Raphael]

(In reply to Kartikaya Gupta (email:[e-mail]) from comment #4)
> Possible dupe of bug 1173831?

Yes you are right

Comment 6

[Raphael]

[Tracking Requested - why for this release]:

Comment 7

[Kevin Brosnan [Ex-Mozilla]]

bug 1173831 leaves the browser in a usable state. This cannot be a dupe of 1173831.

Comment 8

[Kevin Brosnan [Ex-Mozilla]]

I can get into this state by browsing around Vimeo.

Comment 9

[Xidorn Quan [:xidorn] UTC+10]

This bug is somehow reproducible on desktop as well. It messes up the DOM Fullscreen and Fullscreen mode on Firefox desktop.

I'd say this is a bug in Core rather than Firefox.

Comment 10

[Xidorn Quan [:xidorn] UTC+10]

And this bug affects non-e10s only (so Android included).

Comment 11

[Xidorn Quan [:xidorn] UTC+10]

Attachment: part 1 - Not show fullscreen warning when already exit fullscreen. r?dao

Comment 12

[Xidorn Quan [:xidorn] UTC+10]

Attachment: part 2 - Ensure content document handles fullscreen request even if it becomes inactive. r?smaug

Comment 13

[Xidorn Quan [:xidorn] UTC+10]

Attachment: part 3 - Exit fullscreen in non-e10s when no fullscreen request is proceeded. r?smaug

Comment 14

[Xidorn Quan [:xidorn] UTC+10]

Part 1 and part 2 are separate bugs I found when I was debugging. Part 3 is the fix of this bug. The test in part 3 depends on the behavior fix in part 2.

Comment 15

[Dão Gottwald [:dao]]

Comment on attachment 8797897 [details] [diff] [review]
part 1 - Not show fullscreen warning when already exit fullscreen. r?dao

>       case "DOMFullscreen:NewOrigin": {
>-        PointerlockFsWarning.showFullScreen(aMessage.data.originNoSuffix);
>+        // Don't show the warning if we've already exit fullscreen.

grammar nit: "exited"

Comment 16

[Xidorn Quan [:xidorn] UTC+10]

This bug can lead to spoofing of full URL bar for Firefox Android, and it requires no more than normal browsing actions (clicking anything would be enough). Based on the rating rules, I suppose it should be sec-high. But note that it isn't a security issue for desktop Firefox.

Comment 17

[Xidorn Quan [:xidorn] UTC+10]

Comment on attachment 8797900 [details] [diff] [review]
part 3 - Exit fullscreen in non-e10s when no fullscreen request is proceeded. r?smaug

[Security approval request comment]
How easily could an exploit be constructed based on the patch?
An exploit is easy to contruct given the test includes an example. If the test is not included, this probably isn't very easy to construct the exploit from this patch.

Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?
May or may not. This is a security issue for Firefox Android, not for desktop Firefox, while the comment doesn't mention Firefox Android at all, so people may not relate this with the exploit on Android.

Which older supported branches are affected by this flaw?
All current support branches. The related code landed in Firefox 41 in bug 1161802. But given it is an Android-only exploit, I guess we don't need to care about ESR at least.

If not all supported branches, which bug introduced the flaw?
All supported branches.

Do you have backports for the affected branches? If not, how different, hard to create, and risky will they be?
This single patch should be very easy to uplift to all affected branches, and I don't think it is risky. It uses the behavior we've been using in e10s mode. And it only affects edge cases where users shouldn't reach normally.

How likely is this patch to cause regressions; how much testing does it need?
Unlikely. Fullscreen API should be good in terms of test coverage, and this patch also adds a test for this bug.

Comment 18

[Raphael]

Good job Xidorn 3 of the patch for a short time.To spoof the address bar, you can use a GIF or a flash animation that will create a more realistic effect. I guess to use the flash address bar ,as if the site will have to scroll the flash animation of the address bar will simulate the effect of sliding

Comment 19

[James Willcox (:snorp) ([e-mail]) (he/him)]

Xidorn, if possible, can you uplift this to 50?

Comment 20

[Xidorn Quan [:xidorn] UTC+10]

Yes. I think the patches are safe to uplift.

Comment 21

[Al Billings [:abillings - ex-MoCo]]

Comment on attachment 8797900 [details] [diff] [review]
part 3 - Exit fullscreen in non-e10s when no fullscreen request is proceeded. r?smaug

sec-approval+ for trunk without test. The test shouldn't go in until after we ship the fix publicly. 

We should backport this to 51 and 50 if we get nominated patches for those branches.

Comment 22

[Xidorn Quan [:xidorn] UTC+10]

Attachment: part 3 - Exit fullscreen in non-e10s when no fullscreen request is proceeded. r=smaug

The patch with test removed.

Comment 23

[Xidorn Quan [:xidorn] UTC+10]

Attachment: (DON'T CHECKIN UNTIL BUG GETS PUBLIC) part 4 - Add test for this bug. r=smaug

Comment 24

[Xidorn Quan [:xidorn] UTC+10]

https://hg.mozilla.org/integration/mozilla-inbound/rev/3aaf3563a42817c9c20cbb7b2c6052fcaf31728b
https://hg.mozilla.org/integration/mozilla-inbound/rev/6753f22d8e32a9e8829bff251df1789afdbc4c86
https://hg.mozilla.org/integration/mozilla-inbound/rev/21c62360060671267874142ce9140381a685bba2

Comment 25

[Xidorn Quan [:xidorn] UTC+10]

Comment on attachment 8798241 [details] [diff] [review]
part 3 - Exit fullscreen in non-e10s when no fullscreen request is proceeded. r=smaug

Approval Request Comment
[Feature/regressing bug #]: bug 1161802
[User impact if declined]: URL Spoofing for Android users.
[Describe test coverage new/current, TreeHerder]: test is not landed because it provides an example for construct exploit
[Risks and why]: low risk, since the code path it touches shouldn't be reached in normal cases
[String/UUID change made/needed]: n/a

Only part 3 is necessary for fixing this exploit, but I think part 1 and 2 are low risk as well, so they may be uplifted at the same time.

Comment 26

[Raphael]

Proof of address bar spoofing. Crude example, wrote the code on the phone.

Comment 27

[Raphael]

Attachment: Screenshot_2016-10-06-17-.png

Comment 28

[Raphael]

Attachment: poc3.html

Comment 29

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/3aaf3563a428
https://hg.mozilla.org/mozilla-central/rev/6753f22d8e32
https://hg.mozilla.org/mozilla-central/rev/21c623600606

Comment 30

[Xidorn Quan [:xidorn] UTC+10]

(In reply to Dão Gottwald [:dao] from comment #15)
> Comment on attachment 8797897 [details] [diff] [review]
> part 1 - Not show fullscreen warning when already exit fullscreen. r?dao
> 
> >       case "DOMFullscreen:NewOrigin": {
> >-        PointerlockFsWarning.showFullScreen(aMessage.data.originNoSuffix);
> >+        // Don't show the warning if we've already exit fullscreen.
> 
> grammar nit: "exited"

Oops... I just found I forgot to fix this...

Comment 31

[Xidorn Quan [:xidorn] UTC+10]

https://hg.mozilla.org/integration/mozilla-inbound/rev/1b51645a6e483efdb4c9d406f4f2b861e5e75419
Bug 1306696 followup - Fix comment grammar. DONTBUILD

Comment 32

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8798241 [details] [diff] [review]
part 3 - Exit fullscreen in non-e10s when no fullscreen request is proceeded. r=smaug

Sec-high, Aurora51+, Beta50+. Xidorn, do you need to update this Beta/Aurora patch as well to address the review comment?

Comment 33

[Ryan VanderMeulen [:RyanVM]]

I folded the follow-up into part 1.

https://hg.mozilla.org/releases/mozilla-aurora/rev/f3a77790b935
https://hg.mozilla.org/releases/mozilla-aurora/rev/a380fda52593
https://hg.mozilla.org/releases/mozilla-aurora/rev/7acf3f690d58

https://hg.mozilla.org/releases/mozilla-beta/rev/145e220b0054
https://hg.mozilla.org/releases/mozilla-beta/rev/2a7a36b41b82
https://hg.mozilla.org/releases/mozilla-beta/rev/b9a54c39bedd

Comment 34

[Xidorn Quan [:xidorn] UTC+10]

Thanks.

Comment 35

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/1b51645a6e48

Comment 36

[Daniel Veditz [:dveditz]]

Xidorn: in comment 9 you said desktop was affected, but later you said it wasn't. ESR-45 is non-e10s if desktop is vulnerable in any way.

Comment 37

[Xidorn Quan [:xidorn] UTC+10]

On desktop, users always have way to exit from fullscreen state, and moving cursor to the top would show the toolbar like in fullscreen mode.

It might be moderately vulnerable given that the fullscreen notice (the "some site is in full screen" message) is not shown. However, it seems to me this bug is only reliable when there is active fullscreen transition, that means on desktop, users would either see a fullscreen transition, or it would not go fullscreen at all, so I guess it isn't that vulnerable.

It is more serious on mobile because user has no way to exit fullscreen, and there is neither any notice nor any transition animation.

Comment 38

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/ab54d7ef9a67
part 4 - Add test for this bug. r=smaug

Comment 39

[Andreea Pavel [:apavel]]

Backed out for failing mochitest browser chrome at dom/html/test/browser_fullscreen-newtab.js

Push that started the failures: https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=ab54d7ef9a6706a485fdf9d3b0117360beca0a57

Failure log: https://treeherder.mozilla.org/logviewer.html#?job_id=162408780&repo=mozilla-inbound&lineNumber=16431

Backout: https://hg.mozilla.org/integration/mozilla-inbound/rev/bac997577acd18c496aaa3fc3937da61bb3067b4

Comment 40

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/e51946bbcce3
part 4 - Add test for this bug. r=smaug

Comment 41

[Cristian Brindusan [:cbrindusan]]

Backed out for bc failures in dom/html/test/browser_fullscreen-newtab.js:

https://hg.mozilla.org/integration/mozilla-inbound/rev/0be0607b050e9eeaff114166618b0e486dcaa79b

Push with failures: https://treeherder.mozilla.org/#/jobs?repo=mozilla-inbound&revision=e51946bbcce31799dfd5032193f4c186bfc19664&filter-resultStatus=testfailed&filter-resultStatus=busted&filter-resultStatus=exception&filter-resultStatus=success

Failure log: https://treeherder.mozilla.org/logviewer.html#?job_id=162606986&repo=mozilla-inbound&lineNumber=3630 

02:13:12     INFO - TEST-OK | dom/html/test/browser_fullscreen-contextmenu-esc.js | took 1604ms
02:13:12     INFO - checking window state
02:13:12     INFO - TEST-START | dom/html/test/browser_fullscreen-newtab.js
02:13:28     INFO - GECKO(2061) | 2018-02-16 02:13:28.206 firefox[2061:16262] Persistent UI failed to open file file:///Users/cltbld/Library/Saved%20Application%20State/org.mozilla.nightly.savedState/window_1.data: No such file or directory (2)
02:13:57     INFO - TEST-INFO | started process screencapture
02:13:57     INFO - TEST-INFO | screencapture: exit 0
02:13:57     INFO - Buffered messages logged at 02:13:12
02:13:57     INFO - Entering test bound 
02:13:57     INFO - Buffered messages logged at 02:13:13
02:13:57     INFO - Console message: [JavaScript Error: "TelemetryStopwatch: key "FULLSCREEN_CHANGE_MS" was already initialized" {file: "resource://gre/modules/TelemetryStopwatch.jsm" line: 352}]
02:13:57     INFO - start@resource://gre/modules/TelemetryStopwatch.jsm:352:9
02:13:57     INFO - start@resource://gre/modules/TelemetryStopwatch.jsm:133:12
02:13:57     INFO - handleEvent@chrome://browser/content/browser-fullScreenAndPointerLock.js:390:9
02:13:57     INFO - exitDomFullScreen@chrome://browser/content/browser-fullScreenAndPointerLock.js:356:5
02:13:57     INFO - addTab@chrome://browser/content/tabbrowser.xml:2865:13
02:13:57     INFO - loadOneTab@chrome://browser/content/tabbrowser.xml:1790:23
02:13:57     INFO - _openURIInNewTab@chrome://browser/content/browser.js:5145:15
02:13:57     INFO - browser_getContentWindowOrOpenURIInFrame@chrome://browser/content/browser.js:5301:12
02:13:57     INFO - browser_createContentWindowInFrame@chrome://browser/content/browser.js:5275:12
02:13:57     INFO - 
02:13:57     INFO - Console message: [JavaScript Error: "TelemetryStopwatch: requesting elapsed time for nonexisting stopwatch. Histogram: "FULLSCREEN_CHANGE_MS", key: "null"" {file: "resource://gre/modules/TelemetryStopwatch.jsm" line: 373}]
02:13:57     INFO - timeElapsed@resource://gre/modules/TelemetryStopwatch.jsm:373:9
02:13:57     INFO - finish@resource://gre/modules/TelemetryStopwatch.jsm:394:17
02:13:57     INFO - finish@resource://gre/modules/TelemetryStopwatch.jsm:219:12
02:13:57     INFO - receiveMessage@chrome://browser/content/browser-fullScreenAndPointerLock.js:416:9
02:13:57     INFO - 
02:13:57     INFO - Console message: [JavaScript Error: "TelemetryStopwatch: requesting elapsed time for nonexisting stopwatch. Histogram: "FULLSCREEN_CHANGE_MS", key: "null"" {file: "resource://gre/modules/TelemetryStopwatch.jsm" line: 373}]
02:13:57     INFO - timeElapsed@resource://gre/modules/TelemetryStopwatch.jsm:373:9
02:13:57     INFO - finish@resource://gre/modules/TelemetryStopwatch.jsm:394:17
02:13:57     INFO - finish@resource://gre/modules/TelemetryStopwatch.jsm:219:12
02:13:57     INFO - receiveMessage@chrome://browser/content/browser-fullScreenAndPointerLock.js:416:9
02:13:57     INFO - 
02:13:57     INFO - Buffered messages finished
02:13:57     INFO - TEST-UNEXPECTED-FAIL | dom/html/test/browser_fullscreen-newtab.js | Test timed out - 
02:13:57     INFO - GECKO(2061) | MEMORY STAT | vsize 4497MB | residentFast 459MB | heapAllocated 81MB
02:13:57     INFO - TEST-OK | dom/html/test/browser_fullscreen-newtab.js | took 45014ms
02:13:57     INFO - Not taking screenshot here: see the one that was previously logged
02:13:57     INFO - TEST-UNEXPECTED-FAIL | dom/html/test/browser_fullscreen-newtab.js | Found a tab after previous test timed out: about:blank - 
02:13:57     INFO - Not taking screenshot here: see the one that was previously logged
02:13:57     INFO - TEST-UNEXPECTED-FAIL | dom/html/test/browser_fullscreen-newtab.js | Found a tab after previous test timed out: http://example.org/browser/dom/html/test/file_fullscreen-newtab.html - 
02:13:57     INFO - checking window state

Comment 42

[Xidorn Quan [:xidorn] UTC+10]

Looks like it fails on macOS: https://treeherder.mozilla.org/#/jobs?repo=try&revision=cfcf47579a6783b2537cf4b7c49c277c47fbb727

I'm going to land the test with it disabled on macOS, and open a new bug to track why it fails there.

Comment 43

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/43ace919d4d6
part 4 - Add test for this bug. r=smaug

Comment 44

[Andrei Ciure[:aciure]]

https://hg.mozilla.org/mozilla-central/rev/43ace919d4d6

Comment 45

[Stefan Deiac]

Hi, I can reproduce the issue following the steps from the description on the affected version (Firefox 49 Release version).
Devices:

• Prestigio Grace X5 (Android 4.4.2)
• Motorola Nexus 6 (Android 7.1.1)

Also, verified as fixed on the latest versions:

• Nightly 66.0a1 (2018-01-11)
• Beta 65.0b9
• Release 64.0.2

Due to that, I'll remove the qe-verify flag, thanks.