Closed
Bug 1637885
Opened 5 years ago
Closed 5 years ago
Security UI spoofing ( spoofing navigation handler protocol + address bar url )
Categories
(Firefox :: Security, task)
Firefox
Security
Tracking
()
RESOLVED
DUPLICATE
of bug 1636654
People
(Reporter: vijay.tikudave, Unassigned)
Details
(Keywords: reporter-external, Whiteboard: [reporter-external] [client-bounty-form] [verif?])
Attachments
(1 file)
|
449 bytes,
text/html
|
Details |
VULNERABILITY DETAILS
One click user interaction:
Summary:
Navigation to protocol handler URL from the page opened using window.open is considered as a request from the opened page.
Example:
- The page opens google.com
- The page changes opened window's location to ssh://evil.com
- Request to open ssh://evil.com but address bar URL displayed at google.com
VERSION
Firefox 76.0.1 (64-bit)
REPRODUCTION CASE
POC code attached & screenshot as well
IMPACT:
An attacker could trick a user to open malicious protocol handler when address bar referring trusted site.
Flags: sec-bounty?
|
||
Updated•5 years ago
|
Status: UNCONFIRMED → RESOLVED
Closed: 5 years ago
Resolution: --- → DUPLICATE
|
||
Comment 2•5 years ago
|
||
As this is a duplicate of a known issue, it does not qualify for a bounty.
Flags: sec-bounty? → sec-bounty-
|
||
Updated•2 years ago
|
Group: firefox-core-security
|
||
Updated•8 months ago
|
Keywords: reporter-external
You need to log in
before you can comment on or make changes to this bug.
Description
•