1414226 - Firefox does not check integrity of extension files on each startup

Status: RESOLVED INVALID

(Toolkit :: Add-ons Manager, defect)

Description

[SSeg]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.18 Safari/537.36

Steps to reproduce:

1. Install an extension (using WebExtensions) manually, i.e., through the Windows Registry, configuring the folder containing its manifest and the other files. The extension is properly signed by Mozilla through the Developer portal
2. Open Firefox to load the extension
3. Modify the extension files, except the manifest.json (either edit, edit or remove one of them)
4. Restart Firefox


Actual results:

Modifying some of the files did not stop Firefox from loading the extension. The changes were reflected on the extension loaded by Firefox, indicating that it's not using a cached version, without any warning from Firefox.


Expected results:

I'd expect Firefox to calculate the hashes of the files and check them against the ones stored in the manifest.mf - which comes together with the signed package - on every startup. Since someone could modify the scripts contained in the extension, this could be used for malicious purposes.

Comment 1

[Andrew Swan [:aswan]]

This is by design, re-checking signatures is a lot of work and doing it at startup would slow down browser startup.  We do verify signatures in the background, you should see the extension become disabled at some point after startup.
To Exploit this, an attacker would need to have write access to the local filesystem at which point there are many many other nasty things they can do...