Closed Bug 1646984 Opened 6 years ago Closed 6 years ago

X-Frame-Options: Deny bypass

Categories

(Firefox :: Security, task)

Product:
Firefox
Component:
Security
Version:
77 Branch
Type:
task

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1644076

People

(Reporter: terjanq, Unassigned)

References

(
URL
)

Details

(Keywords: reporter-external, Whiteboard: [reporter-external] [web-bounty-form] [verif?])

Looks like a malicious website can completely bypass website's protections against framing the website. This can as well introduce clickjacking throughout the web as it can also introduce more complex issues such as xsleaks and others.

The issue seems to be in <object> and <embed> elements

<object data="https://google.com">
<embed src="https://google.com">

<embed> sometimes shows the page for 2 seconds and then blocks, but it's not very deterministic.

Confirmed to be working on:

  • Firefox 78.0b9 (64-bit)
  • Newest 77.0.1 (64-bit)
  • Firefox Nightly 79.0a1 (2020-06-19) (64-bit)
Flags: sec-bounty?
Group: firefox-core-security
Component: Other → Security
Product: Websites → Firefox
Version: unspecified → 79 Branch

I invested additional time and discovered that the issue is probably a regression that occurred in the latest Firefox 79.0 (stable)

URL: http://terjanq.ml/xss.php?html=%3Cobj... → https://terjanq.me/xfobypass-wjrtipc1...
Version: 79 Branch → 77 Branch

[correction] in the latest Firefox 77.0 (stable)

Thank you terjanq. This is a duplicate of an internal find. We'll get it fixed asap.

Status: UNCONFIRMED → RESOLVED
Closed: 6 years ago
Resolution: --- → DUPLICATE
Group: websites-security
Flags: sec-bounty? → sec-bounty-
Group: firefox-core-security
You need to log in before you can comment on or make changes to this bug.