1605318 - Persistent Denial of Service via External URI Schemes

Status: RESOLVED FIXED

(Firefox for iOS :: General, defect, P1)

Description

[0xsobky]

Attachment: qrcode.png

While Firefox for iOS shows a confirmation dialog for some URI schemes (e.g., sms: and mailto:), it fails to do so with iOS-specific URI schemes such as photos-redirect:, music:, videos:, shareddocuments:, as well as other standard URI schemes (e.g., ftp: and feed:).

A malicious attacker could abuse these URI schemes to make Firefox (and probably the entire iOS system) completely unusable through a simple redirection loop. The following is a proof of concept:
===
Shortened PoC URL: http://bit.ly/iosdos

Full PoC URL: https://chpoc.herokuapp.com/index.php?url=data:text/html,<script>setInterval(%27location="ftp://example.com"%27)</script>
===

Visiting the link above will cause Firefox to repeatedly open an external app (Safari) without giving the user a chance to close the current tab (which also persists after an app/system restart). Here is also a screen recording of what happens exactly: https://youtu.be/Fm2fFPQ6Otw.

For a quick repro, simply scan the attached QR code :-)

Comment 1

[0xsobky]

P.S. This has been tested on Firefox v21.0 on iOS 13.3.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The priority flag is not set for this bug.
:garvan, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 3

[:garvan]

Confirmed the report.

Comment 4

[:garvan]

PR https://github.com/mozilla-mobile/firefox-ios/pull/5986

Comment 5

[Daniel Veditz [:dveditz]]

Does that mean we can mark this bug "fixed"?

Comment 6

[:garvan]

oops, closing as fixed by that PR yes.