1604804 - Firefox iOS download feature SECURITY_TOKEN check bypass and path traversal

Status: RESOLVED FIXED

(Firefox for iOS :: General, defect)

Description

[codecolorist]

Firefox on iOS injects an object named 'firefox' to every page.

For example, firefox.download is implemented here:

https://github.com/mozilla-mobile/firefox-ios/blob/52e120c83644891d0137655fa18e3ef81433d005/Client/Frontend/UserContent/UserScripts/AllFrames/AtDocumentEnd/DownloadHelper.js#L13

To prevent abuse, it has a random SECURITY_TOKEN check:

    if (securityToken !== SECURITY_TOKEN) {
      return;
    }

It makes no sense at all since we can manually send the message:

const str = 'hello world'
webkit.messageHandlers.downloadManager.postMessage({
  filename: '../oops.js',
  base64String: btoa(str),
  mimeType: 'application/octet-stream',
  size: str.length
})

Yeah, poc is pretty simple. DownloadContentScript does no further security check so we can trigger download without user interaction.

https://github.com/mozilla-mobile/firefox-ios/blob/2cf1b45864733724730a95b6c65d2167ddd3ba92/Client/Frontend/Browser/DownloadContentScript.swift#L24

This function uniqueDownloadPathForFilename simply takes our filename param and pass to appendingPathComponent, hence it suffers from path traversal:

https://github.com/mozilla-mobile/firefox-ios/blob/cc3972532e9d66f07038d4528a77a8937751268d/Client/Frontend/Browser/DownloadQueue.swift#L42

This bug is less exploitable, because:

• It can only write file in app sandbox
• It does not override existing files. A new file will be created with a suffix like "hello (1).js"
• There's no such thing like "dynamically loading a jar" on iOS

Comment 1

[Daniel Veditz [:dveditz]]

Sounds mostly like a denial of service type bug, but if you filled up someone's phone they could have a really hard time cleaning up zillions of unwanted files. (maybe they get cleared if you uninstall Firefox? dunno enough about iOS).

Comment 2

[:garvan]

This is a bug indeed, a page can force a download. Without a 'clear all' function this requires deleting the app to clear out the downloads.

Comment 3

[:garvan]

https://github.com/mozilla-mobile/firefox-ios/pull/5935

Comment 4

[codecolorist]

BTW there are more functions vulnerable to TOKEN check bypass