1338575 - Firefox uri scheme may allow open redirection vulnerability to occur in many website

Status: RESOLVED WORKSFORME

(Firefox for iOS :: Browser, defect)

Description

[Seif Elsallamy]

User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Steps to reproduce:

1) open safari
2) go to firefox://example.com/?url=http://www.mozilla.org/


Actual results:

went to http://www.mozilla.org/


Expected results:

An error message should appear
to go to url you must use this way and only this way firefox://open-url?url=
as written in https://github.com/mozilla-mobile/firefox-ios-open-in-client
but firefox://whateverIwant?url isn't a nice way to redirect users 
it may cause a lot of open redirection issues which is a security issue used for phishing and more

Comment 1

[Seif Elsallamy]

It can be used for spoof but that's not what I meant
This bug can bypass a lot of open redirection filters
Which may be used for phishing and in some cases information disclosure

example:

http://example.com/ using an internal redirect to itself at url parameter
http://example.com/?url=http://example.com/home
that gonna redirect users to http://example.com/home

example.com filtering out any domain name other than example.com
http://example.com/?url=http://EvilHacker.com/
that gonna get an error

example.com ignored filtering out protocol part (uri scheme part) forget to restrict the redirects to http and https
http://example.com/?url=firefox://example.com?url=http://EvilHacker.com/
example.com thinks that firefox://example.com is an internal domain
that gonna redirect to firefox://example.com?url=http://EvilHacker.com/
then firefox redirects to http://EvilHacker.com/

example.com's security finally bypassed! in ios firefox browser

I hope that increases the impact clarity

Comment 3

[Seif Elsallamy]

NOT duplicated to 1297353 this is a different issue!!

Comment 4

[Seif Elsallamy]

updates?!!

Comment 5

[:garvan]

I can't reproduce this. Checking for QA confirmation, then close if also no repro

Comment 6

[Catalin Suciu [:csuciu]]

I can't reproduce this issue either.

In my case, going to firefox://example.com/?url=http://www.mozilla.org/ in Safari, prompts to "Open in Firefox". Tapping on "Open", opens Firefox to the about:home page without opening any URL.