1388015 - (CVE-2019-11737) Partial Content Security Policy bypass if host-part contains wildcard

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P2)

Description

[Xiaoyin Liu]

Attachment: CSP wildcard PoC.html

A Content-Security-Policy: img-src https://*:4433 should only allow port 4433, but Firefox allows a URL with all ports.

Reproducible in Firefox Stable 54 and Nightly 57.0a1. Not reproducible in Edge and Chrome.

This is the same issue as https://bugs.chromium.org/p/chromium/issues/detail?id=682673 in Chromium.

Comment 1

[Xiaoyin Liu]

I think the issue is at Line 644 in nsCSPUtils.cpp [1]. If the Host part is *, the function returns true if the scheme is not one of blob:, data:, or filesystem:, without checking the port or path. I think Bug 1075230 is related, since

> +  // 2) host matching: Enforce a single *
> +  if (mHost.EqualsASCII("*")) {
> +    return true;
> +  }

was introduced in the patch for that bug.

[1] https://hg.mozilla.org/mozilla-central/file/7f21a31de9fa/dom/security/nsCSPUtils.cpp#l644

Comment 2

[Christoph Kerschbaumer [:ckerschb]]

Yeah, I think we bail early and allow the load if the wildcard is used for the host without checking the port. I am going to look into that and get that fixed.

Comment 3

[Daniel Veditz [:dveditz]]

Calling this sec-low because if you'll accept any arbitrary host it would be easy for an attacker to use whatever port they needed to bypass CSP anyway. But sure, if the spec says to enforce port then we should do that.

We should check that path is enforced too.

Comment 4

[Xiaoyin Liu]

Any updates on this?

Comment 5

[Sylvestre Ledru [:Sylvestre]]

Moving to p3 because no activity for at least 1 year(s).
See https://github.com/mozilla/bug-handling/blob/master/policy/triage-bugzilla.md#how-do-you-triage for more information

Comment 6

[Sebastian Streich [:sstreich]]

Attachment: Bug 1388015 - Add checks to respect CSP-wildcard + Ports r=ckerschb

Comment 7

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/integration/autoland/rev/f31349fb06dd599f0c60653403889102e12bf5ac

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/f31349fb06dd

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Please nominate this patch for Beta and ESR68 approval when you're comfortable doing so.

Comment 10

[Sebastian Streich [:sstreich]]

Comment on attachment 9073020 [details]
Bug 1388015 - Add checks to respect CSP-wildcard + Ports r=ckerschb

Beta/Release Uplift Approval Request

• User impact if declined: The user is left vulnerable to a CSP-Bypass Attack, if the Page uses a "Wildcard+Port" host in its CSP-Rule
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): The patch just adds a single check in case a "*" is present in the CSP host declaration,
  all the other Code paths for checking the host are left untouched.
• String changes made/needed:

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: Currently Firefox ignores the Port in a CSP Host declaration if the host is "*"
  Which opens a Vector for CSP-Bypassing.
• User impact if declined: The user is left vulnerable to a CSP-Bypass Attack.
• Fix Landed on Version: Nightly 70
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): The patch just adds a single check in case a "*" is present in the CSP host declaration,
  all the other Code paths for checking the host are left untouched.
• String or UUID changes made by this patch:

Comment 11

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9073020 [details]
Bug 1388015 - Add checks to respect CSP-wildcard + Ports r=ckerschb

CSP security improvement with automated tests. Approved for 69.0b6 and 68.1esr.

Comment 12

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/releases/mozilla-beta/rev/127895e5664c

Comment 13

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/releases/mozilla-esr68/rev/fda4a1ea7cf4