1317242 - (CVE-2017-7770) Location Bar Spoofing Risk using the Fullscreen mode and a new tab loaded using the alert()

Status: RESOLVED FIXED

(Firefox for Android Graveyard :: General, defect)

Description

[Jordi Chancel]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:49.0) Gecko/20100101 Firefox/49.0
Build ID: 20161019084923

Steps to reproduce:

Steps to reproduce:

When you go on the fullscreen mode and you load after a new tab with the alert(); , the location bar has disappeared.

1 : Go on http://www.alternativ-testing.fr/Research/Mozilla/android/-K8H4D0-Location_Bar_Spoofing-FullScreen-and-alert-JavaScript-Function/TESTCASE1.HTML and click on the first link (this will activated Fullscreen Mode).

2 : Click on the second link , a new tab will be openned which contains a webpage which load the JavaScript alert(); Function.



Actual results:

Actual results:

Now the location bar is invisible (even if you try to press the back button on android , the location bar has disappeared for always)

you ca use now a fake location bar (leading to a Location Bar Spoofing)



Expected results:

After all these steps, you can use a fake location bar (leading to a Location Bar Spoofing).

Comment 1

[Sebastian Kaspari (:sebastian; :pocmo)]

This is reproducible in all release channels.

Comment 2

[Jordi Chancel]

Attachment: Video Example.html

Comment 3

[Sebastian Kaspari (:sebastian; :pocmo)]

Attachment: no-toolbar.png

This is how it looks like on my phone.

Comment 4

[Sebastian Kaspari (:sebastian; :pocmo)]

@snorp: My guess is that this is more platform-y, what do you think? Otherwise someone from the Taipei team could investigate.

Comment 5

[Sebastian Kaspari (:sebastian; :pocmo)]

Actually this looks a lot like the same issue as bug 1319366: Clicking a link while in full-screen mode using Google slides makes the navigation bar go black.

Comment 6

[Jordi Chancel]

I've coded a better TestCase nedding only one Click on the first Link in TestCase WebPage. 

URL: https://www.alternativ-testing.fr/Research/Mozilla/android/-K8H4D0-Location_Bar_Spoofing-FullScreen-and-alert-JavaScript-Function/TESTCASE2.html 

I will upload video example as soon as possible.

I change the URL of the first TESTCASE used by this new TESTCASE.

Comment 7

[James Willcox (:snorp) ([e-mail]) (he/him)]

Yeah I think this is basically a frontend bug, similar to 1319366 as Sebastian said.

Comment 8

[Sebastian Kaspari (:sebastian; :pocmo)]

Hey Nevin. This security bug looks like it is the same problem as bug 1319366. If you find a solution for bug 1319366 then can you check whether this one here is fixed too?

Comment 9

[Nevin Chen(Not active on Bugzilla)]

Suggest to close this bug since bug 1319366 is landed

Comment 10

[Sebastian Kaspari (:sebastian; :pocmo)]

Can you test if this is fixed for the steps in comment 0? If so then let's close it.

Comment 11

[Nevin Chen(Not active on Bugzilla)]

Attachment: 1317242.mp4

It looks fixed to me. So I'll close this bug.

Comment 13

[Daniel Veditz [:dveditz]]

Be extremely careful about marking security bugs as duplicates! This will almost completely hide the fact that a security bug was fixed which means at the very least:
 - QA never verifies the security fix
 - no advisories are written
 - no CVE is assigned
 - reporter gets no credit, and might even miss out on the bounty itself if no one notices
 - no testcase for the security bug gets added to the tree

This is essentially absolute when the duplicate is a non-security bug. Mark the security bug "depends on" the other bug and call it FIXED.

If the proposed duplicate is a security bug is it really the same? If the primary bug is in any way of a larger scope or has a different testcase then it's not a duplicate, it's a "depends on" relationship.

Comment 14

[Nevin Chen(Not active on Bugzilla)]

Hi Daniel, Al
Got it. Thank you! May I know is there's anything I can do now?

Comment 15

[Al Billings [:abillings - ex-MoCo]]

No, nothing to do. I only set needinfo? to make sure you saw the comment. :-)