1619003 - Kiosk mode bypass in XFCE via keyboard shortcuts

Status: RESOLVED WONTFIX

(Firefox :: Enterprise Policies, task)

Description

[Rachael Hardin]

Firefox version: 73.0.1

OS version: Ubuntu 18.04 desktop with XFCE installed via these steps: https://linuxconfig.org/install-xfce-desktop-on-ubuntu-18-04-bionic-beaver-linux

Other Environment Info: This issue was reproduced in a VM running on VMware Fusion 11.5.1. Host machine is MacOS running Catalina 10.15.3.

Consistently reproducible? Yes

Steps to reproduce:

1. Launch Firefox in Kiosk mode, either via the terminal command $firefox --kiosk <optional URL> or by configuring Firefox in the Panel menu to execute in Kiosk mode

2. Once Firefox launches, press Alt/Option+Space to pull up a context menu. Note that the option to leave fullscreen mode is included.

3. Click "Leave Fullscreen".

At this point, depending on if the menu bar was previously enabled, you can either drop to a fully functional URL bar that can accept arbitrary URLs (I used mozilla.org, cnn.com, and about:config during testing). However, out-of-the-box, the menu bar is still not visible. Tabbing through via Bug 1585401 may also work but wasn't tested here.

4. Press Alt/Option to bring up the menu bar. Note that left-clicking the URL bar in an attempt to interact with it hides the menu bar again, but right-clicking the URL bar opens a functional context menu and that Copy/Paste/Paste&Go are valid options.

5. Utilize Paste & Go with an arbitrary URL. Observe that the request succeeds.

The quickest fix would be to update the Linux compatibility notes (specifically here: https://support.mozilla.org/en-US/kb/firefox-enterprise-kiosk-mode) since this looks DE-specific and isn't an environment with a unified menu. I'd also recommend disabling input to the URL bar and the right-click context menu as additional defense-in-depth measures.

Comment 1

[:Gijs (he/him)]

I don't think we should consider kiosk mode bypasses as security issues.

(In reply to Rachael Hardin from comment #0)

2. Once Firefox launches, press Alt/Option+Space to pull up a context menu. Note that the option to leave fullscreen mode is included.

3. Click "Leave Fullscreen".

What context menu is this? A Firefox one, or an XFCE one, or ...? A screenshot would help.

Comment 2

[Mike Kaply [:mkaply] (PTO until Sept 14)]

We should update the documentation. When we released kiosk mode, we said that it is a basic kiosk mode that assumes that there is no keyboard available. There are tons of other things you can do if you have access to a keyboard as well.

Blocking keyboard access is up the kiosk implementer (via software or not having a keyboard).

We don't actually block any Firefox keyboard shortcuts.

But I definitely would like to see a screenshot.

Comment 3

[Rachael Hardin]

Attachment: Context_menu.png

Comment 4

[Rachael Hardin]

Added a screenshot. It's not a firefox context menu. I found the kiosk mode documentation here: https://firefox-source-docs.mozilla.org/browser/components/enterprisepolicies/docs/index.html

While those claims make sense, would it be possible to sync them with the KB to reduce confusion?

Comment 5

[Mike Kaply [:mkaply] (PTO until Sept 14)]

I've submitted a change to the KB article for this. Thanks for pointing it out.

I'm adding:

=Special Note=
33 + The kiosk mode provided by Firefox is a very basic mode intended for kiosks where the content loaded in the browser is strictly limited by the owner of the kiosk and either there is no keyboard or keyboard access is limited (particularly Ctrl and Alt). It is up to the kiosk owner to ensure the content does not surprise/confuse users or break browser UI in this setup.

I am marking this bug as WONTFIX since there's nothing in code.

Thanks!