1346697 - Should encrypt hostname and formSubmitURL in logins.json to avoid password compromise via a combination of local access and convincing the user to submit login data to alternative hostname/formsubmitURL

Status: VERIFIED WONTFIX

(Toolkit :: Password Manager, defect)

Description

[huynhok.uit]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Build ID: 20170307144106

Steps to reproduce:

1. Set strong master password which cannot be cracked.
2. Save some password site and log out, clear all cookie, history.
3. Edit ~/.mozilla/firefox/profile-id/logins.json with 'hostname' and 'FormsubmitURL' with attacker url.
4. Access attacker url with autocomplete and auto post, account and password sent to attacker server without known master password when user visited.


Actual results:

Attacker with physical access or remote code execution can edit to trick victim send account and password to malicious url.



Expected results:

When master password is set, it should encrypt all hostname and FormsubmitURL.

Comment 1

[:Gijs (he/him)]

This attack would require:
- local machine compromise, AND
- write access to the profile folder on the local machine, AND
- convincing the user to navigate to & log in on evil.com


That seems pretty far-fetched. Matt?

Comment 2

[huynhok.uit]

It likes lack of feature when use master password. Attacker just visit user's computer and sed all url with their own and make their page as default...
If user doesnot use master password, attacker can get all .mozilla directory, it's easier.

This attack requires other attack such as rce or temporary physical access

Comment 3

[Matthew N. [:MattN]]

If you already have access to the computer or RCE you could just as easily:
1) install a keylogger that uploads to a server
2) take a copy of logins.json
3) wait for the user to enter their master password and use it to decrypt the logins

Last I checked Windows keyloggers don't even require elevated privileges. A hardware keylogger could also work if you have access to the machine later too.

There are many other ways to steal the credentials if you have local access or can run code via RCE so I don't think this is worth changing at this time.

By the way, the reason we don't encrypt the origin and formSubmitURL is because we don't want to prompt the user to enter their master password unless we actually have a matching saved login. We need these two pieces of information to know whether a saved login matches a form.