1567781 - SeaMonkey website does not enforce HTTPS which makes it vulnerable to MITM attacks

Status: RESOLVED FIXED

(SeaMonkey :: Website, defect)

Description

[privatecodey]

Attachment: Vulnerable site

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3843.0 Safari/537.36 Edg/77.0.218.4

Steps to reproduce:

1. Type in Seamonkey in Google search
2. Site is opened via http over an insecure connection

Actual results:

The site was opened via a http connection and did not enforce https. This is vulnerable to a man in the middle attack where an attacker can upload fake versions of the program.

Expected results:

The site should've been redirected to an https variant of the site.

Comment 1

[:Gijs (back August 25; he/him)]

No point keeping this bug hidden.

Comment 2

[Nuno Silva [:njsg]]

Attachment: 1567781-1-remove-protocol-and-host

A patch to remove the protocol and hostname parts of addresses in redirection directives.

Comment 3

[Ian Neal]

Comment on attachment 9166829 [details] [diff] [review]
1567781-1-remove-protocol-and-host

> RedirectMatch temp ^/security/(.*)$ http://www.mozilla.org/security/$1
Perhaps point this at the https version?

> # flexible solution for hard-coded link in SeaMonkey Help
>-Redirect temp /doc/troubleshooting http://www.seamonkey-project.org/releases/seamonkey2.53.1/#troubleshooting
>+Redirect temp /doc/troubleshooting /releases/seamonkey2.53.1/#troubleshooting
This should probably be 2.53.3 and we need to remember to change on each release

r=me with those addressed.

Comment 4

[Nuno Silva [:njsg]]

Attachment: 1567781-1-remove-protocol-and-host [Checked in: Comment 5]

Comment 5

[Ian Neal]

Comment on attachment 9167470 [details] [diff] [review]
1567781-1-remove-protocol-and-host [Checked in: Comment 5]

https://hg.mozilla.org/SeaMonkey/seamonkey-project-org/rev/872aab9b65a376b5ddb93347315a762c7600ce00
https://gitlab.com/seamonkey-project/website/-/commit/730060c2e0b38cfa53bb722385bbf778c941a375

Comment 6

[Ian Neal]

Also configured apache to redirect from http to https by adding to VirtualHost configuration of webserver:
Redirect permanent / https://www.seamonkey-project.org/