1484753 - (CVE-2018-12403) Firefox doesn't mark sites with http favicons as mixed content

Status: RESOLVED FIXED

(Firefox :: Security, defect)

Description

[Yiğit Can YILMAZ]

Attachment: proof.mov

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36

Steps to reproduce:

1- Open the Firefox
2- Go this website : https://mixed-favicon.badssl.com/




Actual results:

Although a web page icon loads as http, it may appear secure.

proof of concept:
proof.mov


Expected results:

Please look at the https://mixed-favicon.badssl.com's source code. You can see favicon icon as https. But if you open favicon file, it' redirecting to http page. This means : favicon file loading as http. This means : web page is not secure. But Firefox show web page as secure

Comment 1

[Johann Hofmann [:johannh]]

I can't reproduce this, the mixed content UI shows fine for me. What version of Firefox are you using?

Comment 2

[Yiğit Can YILMAZ]

61.0.2

Comment 3

[Johann Hofmann [:johannh]]

Hmm, seems like this got fixed in Nightly, I can reproduce on Beta and Release as well. Would you mind testing this in Firefox Nightly and see if the issue is fixed for you?

Thanks!

Comment 4

[Yiğit Can YILMAZ]

Hello,
Yes. Fixed with nightly version. But I can reproduce on Firefox iOS. Can i create a different report for this ?

Thanks!

Comment 5

[Johann Hofmann [:johannh]]

(In reply to Yiğit Can YILMAZ from comment #4)
> Hello,
> Yes. Fixed with nightly version. But I can reproduce on Firefox iOS. Can i
> create a different report for this ?
> 
> Thanks!

Yes, it's preferable to create another bug for Firefox for iOS. Bugzilla has a separate component for this. Thanks!

I'm closing this bug as worksforme then, I'm not removing the security flag until we know that the bug that resolved this isn't s-s either.

Maybe jkt or ckerschb know what fixed this.

Comment 6

[:Gijs (he/him)]

I expect this will have been fixed by Mossop's changes to favicon loading. We may want to mark this bug fixed and set the relevant affected/fixed versions.

Comment 7

[Dave Townsend [:mossop]]

(In reply to :Gijs (he/him) from comment #6)
> I expect this will have been fixed by Mossop's changes to favicon loading.
> We may want to mark this bug fixed and set the relevant affected/fixed
> versions.

My changes didn't land until 63 though and this claimed to have been resolved in 61. Do we have a test in tree for this case? It's possible my change may have affected this.

Comment 8

[Yiğit Can YILMAZ]

Hello,
this problem can be reproduced in 61.0.2. If you want to demonstrate you can see "proof.mov" in attachments. But this problem can not be reproduced in the "nightly" version. I can not reproduced in the nightly version. Also, this problem is reproducible for firefox iOS(13.1). I created a new report for iOS . You can see https://bugzilla.mozilla.org/show_bug.cgi?id=1484916 .

Best Regards,
Yiğit

Comment 9

[Yiğit Can YILMAZ]

Please check it 

Best Regards,
Yiğit

Comment 10

[Johann Hofmann [:johannh]]

(In reply to Dave Townsend [:mossop] from comment #7)
> (In reply to :Gijs (he/him) from comment #6)
> > I expect this will have been fixed by Mossop's changes to favicon loading.
> > We may want to mark this bug fixed and set the relevant affected/fixed
> > versions.
> 
> My changes didn't land until 63 though and this claimed to have been
> resolved in 61. Do we have a test in tree for this case? It's possible my
> change may have affected this.

To clarify, this is fixed in Nightly (63) and broken in 61 and 62, so that sounds a lot like your patch fixed it.

I don't think we have a test for it yet, since that test would have been broken until your change. It would be a good idea to write one.

Comment 11

[Yiğit Can YILMAZ]

Hello,
Can you fix it for firefox iOS ? No one responded to my "firefox for iOS" report

Comment 12

[Dave Townsend [:mossop]]

(In reply to Yiğit Can YILMAZ from comment #11)
> Hello,
> Can you fix it for firefox iOS ? No one responded to my "firefox for iOS"
> report

Unfortunately no-one involved in this conversation is an iOS engineer. I'm afraid you just need to wait till someone from the iOS side of things looks into your report.

Comment 13

[Dave Townsend [:mossop]]

Attachment: Bug 1484753: Loading an insecure favicon should make the page show as mixed content. r=johannh

Comment 14

[Dave Townsend [:mossop]]

Let's use this to get a test landed.

Comment 15

[:Gijs (he/him)]

Comment on attachment 9002841 [details]
Bug 1484753: Loading an insecure favicon should make the page show as mixed content. r=johannh

:Gijs (he/him) has approved the revision.

Comment 16

[Johann Hofmann [:johannh]]

Comment on attachment 9002841 [details]
Bug 1484753: Loading an insecure favicon should make the page show as mixed content. r=johannh

Johann Hofmann [:johannh] has approved the revision.

Comment 17

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/1cba447409917569d3d44d814fd13ba2e6244006
https://hg.mozilla.org/mozilla-central/rev/1cba44740991

Comment 18

[Ryan VanderMeulen [:RyanVM]]

This sounds like a sec-low that's riding the trains, but feel free to correct that if I'm misunderstanding.

Comment 19

[Johann Hofmann [:johannh]]

I agree with that assessment.

Comment 20

[Johann Hofmann [:johannh]]

(And there may be a public dupe of this somewhere).

Comment 21

[Yiğit Can YILMAZ]

Can you give me bug bounty ? and can you add me hall of fame ?

Best Regards,
Yiğit

Comment 22

[:Gijs (he/him)]

(In reply to Yiğit Can YILMAZ from comment #21)
> Can you give me bug bounty ? and can you add me hall of fame ?
> 
> Best Regards,
> Yiğit

The bounty committee makes these decisions, not Dave (or me), and you can't request consideration like this - you should follow the guidance on https://www.mozilla.org/en-US/security/client-bug-bounty/ .

That said, this is rated sec-low and is therefore not eligible for a bounty - only sec-critical, sec-high and sometimes sec-moderate severity bugs are eligible for a bounty.

Comment 23

[Yiğit Can YILMAZ]

Can you add me to hall of fame ?

Thanks,
Yiğit

Comment 24

[Dave Townsend [:mossop]]

(In reply to Yiğit Can YILMAZ from comment #23)
> Can you add me to hall of fame ?
> 
> Thanks,
> Yiğit

I don't know what that is.

Comment 25

[Yiğit Can YILMAZ]

Fır ecample : https://www.mozilla.org/en-US/security/advisories/mfsa2018-15/

Comment 26

[Dave Townsend [:mossop]]

(In reply to Yiğit Can YILMAZ from comment #25)
> Fır ecample : https://www.mozilla.org/en-US/security/advisories/mfsa2018-15/

I don't know what the process is here. I suspect it depends on this being assigned a CVE which seems unlikely here

Comment 27

[Yiğit Can YILMAZ]

Can you add me to security advisories? how would i know that?

Comment 28

[Daniel Veditz [:dveditz]]

(In reply to Yiğit Can YILMAZ from comment #21)
> Can you give me bug bounty ? and can you add me hall of fame ?

Our bug bounty program is described at https://www.mozilla.org/en-US/security/client-bug-bounty/

I'll go ahead and tag this bug for evaluation but sec-low bugs generally don't qualify.

Comment 29

[Daniel Veditz [:dveditz]]

The bounty committee agrees that this does not qualify for a reward