Firefox for Android custom tabs URL spoofing
Categories
(Firefox for Android Graveyard :: General, defect)
Tracking
(firefox-esr6875+ fixed, firefox73 unaffected, firefox74 unaffected, firefox75 unaffected, firefox76 unaffected)
Tracking | Status | |
---|---|---|
firefox-esr68 | 75+ | fixed |
firefox73 | --- | unaffected |
firefox74 | --- | unaffected |
firefox75 | --- | unaffected |
firefox76 | --- | unaffected |
People
(Reporter: jupenur, Assigned: petru)
References
(Regression)
Details
(4 keywords, Whiteboard: [reporter-external] [client-bounty-form] [verif?][adv-esr68.7+])
Attachments
(4 files)
158 bytes,
text/html
|
Details | |
47 bytes,
text/x-phabricator-request
|
RyanVM
:
approval-mozilla-esr68+
tjr
:
sec-approval+
|
Details | Review |
75.46 KB,
image/jpeg
|
Details | |
330 bytes,
text/plain
|
Details |
Custom tabs in Firefox for Android fail to update the URL correctly, allowing malicious websites to spoof other origins.
Steps to reproduce:
- Host the attached file (spoof.html) at the following URL: http://evil.example/spoof.html
- Open the following URL in Firefox for Android: intent://evil.example/spoof.html#Intent;package=org.mozilla.firefox;action=android.intent.action.VIEW;scheme=http;S.android.support.customtabs.extra.SESSION=;end;
- Observe how a custom tab opens, the URL changes to "https://google.com/", yet content is displayed from the "evil.example" host
Comment 1•5 years ago
|
||
Snorp, Stefan, can you take a look, please?
I see the issue. We get some progress callbacks, including onPageStart()
from GeckoView. The load is then aborted, and we get onPageStop()
with an "unsuccessful" value passed along. Unfortunately, Fennec changes the displayed URL in onPageStart()
[1] and never changes it back after onPageStop()
. We should only be changing the displayed URL in onLocationChange()
.
Petru, can you please remove the line that I linked to below?
Assignee | ||
Comment 4•5 years ago
|
||
Updated•5 years ago
|
Assignee | ||
Comment 5•5 years ago
|
||
Comment on attachment 9133236 [details]
Bug 1622278 - Ensure displayed URL in modified only in onLocationChange(); snorp
ESR Uplift Approval Request
- If this is not a sec:{high,crit} bug, please state case for ESR consideration: Security issue - url spoofing
- User impact if declined: Url spoofing in custom tabs. Users may be tricked about the real website origin.
- Fix Landed on Version:
- Risk to taking this patch: Low
- Why is the change risky/not risky? (and alternatives if risky): Very small change
- String or UUID changes made by this patch:
Comment 6•5 years ago
|
||
Comment 7•5 years ago
|
||
Even if the URL is switched too early, why are we showing the lock if we haven't securely connected? (see screenshot) are we just parsing the scheme at that point?
Updated•5 years ago
|
Updated•5 years ago
|
Comment 8•5 years ago
|
||
This is Fennec-only code which only exists on ESR68.
Comment 9•5 years ago
|
||
Comment on attachment 9133236 [details]
Bug 1622278 - Ensure displayed URL in modified only in onLocationChange(); snorp
Approved to land.
Comment 10•5 years ago
|
||
Comment on attachment 9133236 [details]
Bug 1622278 - Ensure displayed URL in modified only in onLocationChange(); snorp
Fixes a sec bug. Approved for Fennec 68.7b1.
Comment 11•5 years ago
|
||
uplift |
Comment 12•5 years ago
|
||
(In reply to Ryan VanderMeulen [:RyanVM] from comment #8)
This is Fennec-only code which only exists on ESR68.
I believe that is incorrect: Snorp said in comment 2 it regressed from when Fennec switched to using shared GeckoView code for this in bug 1356346. ni? him or petru to check me on that, and to see if this has landed on trunk and should be left fixed, or reopened until that happens.
Updated•5 years ago
|
(In reply to Daniel Veditz [:dveditz] from comment #12)
(In reply to Ryan VanderMeulen [:RyanVM] from comment #8)
This is Fennec-only code which only exists on ESR68.
I believe that is incorrect: Snorp said in comment 2 it regressed from when Fennec switched to using shared GeckoView code for this in bug 1356346. ni? him or petru to check me on that, and to see if this has landed on trunk and should be left fixed, or reopened until that happens.
Right, the problem is in Fennec-only code which uses GeckoView, not in GV itself.
Assignee | ||
Updated•5 years ago
|
Updated•5 years ago
|
Updated•5 years ago
|
Comment 14•5 years ago
|
||
Updated•5 years ago
|
Updated•4 years ago
|
Updated•4 years ago
|
Updated•8 months ago
|
Description
•