1436485 - Cross Site XSS ( Cross Site Scripting ) at Firefox Focus for Android

Status: RESOLVED DUPLICATE of bug 1739934

(Focus :: General, defect)

Description

[u608619]

Attachment: firefox_focus_xss.png

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36

Steps to reproduce:

Hello Mozilla Security Team,

I downloaded the Firefox Focus app from Google Play. -> Latest version. I turned on the Firefox Focus application. I wrote javascript: alert ('ismailtasdelen') javascript payload in the search section. And I did the search. I printed my name on the screen of the mobile app.

Mobile App : Firefox Focus
Mobile App Version : Last version.
Phone & Device Model : Nokia 6
Device OS : Android
OS Version : Android 8.0 Oreo

XSS Payload : Javascript:alert('ismailtasdelen')


Actual results:

I could run XSS Payload.


Expected results:

I could successfully execute the Javascript code (:

Comment 1

[Kevin Brosnan [Ex-Mozilla]]

How are you handling Focus security bugs? This does not belong in Firefox for Android.

Comment 2

[u608619]

Mobile apps running on IOS and Android platform are running my xss payload.

Comment 3

[u608619]

Javascript:alert(1) --> I used the JavaScript code.

Comment 4

[:sdaswani]

Can someone from the sec team give us a security severity on this - sec low, moderate, or high?

Comment 5

[u608619]

I wanted to let you know that I found a low level xss security vulnerability ((:

Comment 6

[Frederik Braun [:freddy]]

Thank you for reporting this bug to us.

I understand this is a self-xss. The user has to type in the attacking code themselves.
Rating sec-low according to our ratings at <https://wiki.mozilla.org/Security_Severity_Ratings>
Also, the code seems to be running at low privileges (e.g., location.href == "about:blank).

Note that the URL is case-sensitive. "javascript:alert(1)" in the URL bar does not seem to work, but "Javascript:alert(1)" (uppercase) does.
If we have any checks that are supposed to stop those kind of things, we should ensure them being case-insensitive.

Comment 7

[:sdaswani]

(In reply to Frederik Braun [:freddyb] from comment #6)
> Thank you for reporting this bug to us.
> 
> I understand this is a self-xss. The user has to type in the attacking code
> themselves.
> Rating sec-low according to our ratings at
> <https://wiki.mozilla.org/Security_Severity_Ratings>
> Also, the code seems to be running at low privileges (e.g., location.href ==
> "about:blank).
> 
> Note that the URL is case-sensitive. "javascript:alert(1)" in the URL bar
> does not seem to work, but "Javascript:alert(1)" (uppercase) does.
> If we have any checks that are supposed to stop those kind of things, we
> should ensure them being case-insensitive.

Thanks for the security ranking Frederik!

Comment 8

[u608619]

https://www.mozilla.org/en-US/security/bug-bounty/hall-of-fame/ --> I am delighted if you add my name to the report I am reporting. More important than the gift from the money for me (:

Thanks

Comment 9

[u608619]

Hey, what's the latest situation? The report has not been finalized and is still not fixed. I would also like to add it to the Hall of Fame list.

Comment 10

[:sdaswani]

Daniel - can you advise on 1) security rating - low medium high and 2) hall of fame?

Thanks!

Comment 11

[u608619]

Hello,

XSS weaknesses are considered as medium.

Hall of Fame https://www.mozilla.org/en-US/security/bug-bounty/hall-of-fame/

İsmail Taşdelen

Thanks (:

Comment 12

[u608619]

Hello,

I did not say my social media account.

İsmail Taşdelen - https://www.linkedin.com/in/ismailtasdelen/

If there is a character problem at the end, you can write it as "Ismail Tasdelen".

Thanks

Comment 13

[Kevin Brosnan [Ex-Mozilla]]

This has already been rated sec-low as it requires the attacker to convince the user to type or paste the code into the address bar of Focus Android. 

As I understand the security HOF is for researchers that received awards for sec-high or sec-critical bugs as outlined in https://www.mozilla.org/en-US/security/bug-bounty/faq/#eligible-bugs Leaving the NI to Dan to confirm this.

Comment 14

[:sdaswani]

(In reply to Kevin Brosnan [:kbrosnan] from comment #13)
> This has already been rated sec-low as it requires the attacker to convince
> the user to type or paste the code into the address bar of Focus Android. 
> 
> As I understand the security HOF is for researchers that received awards for
> sec-high or sec-critical bugs as outlined in
> https://www.mozilla.org/en-US/security/bug-bounty/faq/#eligible-bugs Leaving
> the NI to Dan to confirm this.

Thanks Kevin. I also am facepalming for not reading the sec-low rating! :/

Comment 15

[Daniel Veditz [:dveditz]]

Flagging for the bounty committee per comment 8.

So far the client security Hall of Fame has included only people who were awarded bounties (sec-low are usually not eligible). The Web hall of fame _does_ include people who have found valid issues but weren't awarded a bounty -- it depends on the site involved.

Comment 16

[u608619]

If you recieve a return, then you can close the report.

Comment 17

[u608619]

Yes

Comment 18

[:sdaswani]

Emily another security bug you can take a stab at.