1434634 - (CVE-2019-9808) Incomplete fix of bug 1366357

Status: VERIFIED FIXED

(Firefox :: Site Identity, defect, P3)

Description

[Jun (Request needinfo for comment, I ignore other updates)]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.119 Safari/537.36

Steps to reproduce:

1. Go to https://vuln.shhnjk.com/iframer.php?url=//test.shhnjk.com/permission.html
2. Click on "Cam Data" button


Actual results:

Permission notification says "Unknown origin" is requesting permission.


Expected results:

Bug 1366357 fix made "Unknown protocol" to "Unknown origin", which I don't think solved the issue of confusing permission request.

Tested in Latest Nightly.

Comment 1

[:Gijs (he/him)]

Johann, can you take a look? Off-hand, I would imagine we should prompt for the origin that created the blob?

Comment 2

[Johann Hofmann [:johannh]]

This will be fixed by bug 1371741 by disallowing null-principals from accessing data:, which is why I ignored the issue in bug 1366357. I'm not sure what the status of bug 1371741 is. I have a patch waiting for jib to review there so I'll defer to him to sort out this bug :)

Comment 3

[Johann Hofmann [:johannh]]

> disallowing null-principals from accessing data:

I meant from accessing getUserMedia :)

Comment 4

[Jun (Request needinfo for comment, I ignore other updates)]

Okay, seems like CSP sandbox is not considered in WebRTC permission.

PoC
https://shhnjk.azurewebsites.net/csp_sandbox.php?csp=allow-scripts&xss=%3Cscript%3Enavigator.mediaDevices.getUserMedia({video:%20{facingMode:%20%27user%27}})%3C/script%3E

It shows origin based on URL and does not check whether Document is sandbox. Should I file this as a separate bug?

Comment 5

[Johann Hofmann [:johannh]]

Hm, that's the same thing, it's a null principal so it should just get disallowed in bug 1371741. I'll try to get a hold of jib for answering this...

Comment 6

[Jun (Request needinfo for comment, I ignore other updates)]

Oh, yeah it's clearly mentioned there :D Sorry :P

Comment 7

[Johann Hofmann [:johannh]]

No worries, thanks for looking into this!

Comment 8

[Johann Hofmann [:johannh]]

Now that bug 1371741 got fixed I think we can close this as done as well, Jun, can you confirm that you can no longer request permissions for "Unknown Origin" in the latest Nightly?

Comment 9

[Daniel Bodea [:danibodea]]

Jun, does this issue still need verification?
If yes, can you explain exactly what should be verified?
I could confirm the fix in all the main OSes.

Thank you for your contribution!

Comment 10

[Jun (Request needinfo for comment, I ignore other updates)]

Sorry just noticed this. I can confirm that this is fixed in Nightly :)

Comment 11

[Johann Hofmann [:johannh]]

Thanks Jun, I think that's enough to verify :)

Comment 12

[Daniel Bodea [:danibodea]]

Alright. Thank you!