1657026 - (CVE-2020-26954) Any websites can run with PWA privileges on Fenix

Status: RESOLVED FIXED

(Fenix :: General, defect)

Description

[Muneaki Nishimura]

Attachment: dummy_manifest.json

Fenix has a public interface that allows any apps to inject arbitrary PWA manifest for any origin.
That can be used for installing malicious PWAs on victim's device silently.
The installed PWA runs in fullscreen so spoofing address bar is possible by their contents.
Also through the malicious PWA's manifest, fake share_target (tries to steal victim's shared contents) can be registered (below).
https://github.com/mozilla-mobile/android-components/blob/ba0d00e94b15bb5ad1383c726a66340b80d6fe14/components/concept/engine/src/main/java/mozilla/components/concept/engine/manifest/WebAppManifestParser.kt#L79

The root cause is that LauncherActivity in Fenix is publicly accessible (below).
https://github.com/mozilla-mobile/fenix/blob/master/app/src/main/AndroidManifest.xml#L64
That activity receives MANIFEST_PATH key from incoming intent and store the specified manifest file to internal manifest database (below).
https://github.com/mozilla-mobile/fenix/blob/16b677693832d54c64f2ab1f67f0a881a704889d/app/src/main/java/org/mozilla/fenix/customtabs/FennecWebAppIntentProcessor.kt#L93

Here is the demo.

1. Save attached dummy_manifest.json file to your PC and send it to the connected Android device through ADB.

adb push dummy_manifest.json /data/local/tmp/dummy_manifest.json

2. Inject the manifest for example.com via org.mozilla.gecko.WEBAPP intent.

adb shell am start -a org.mozilla.gecko.WEBAPP -d 'https://example.com/' -n org.mozilla.fenix/org.mozilla.gecko.LauncherActivity --es MANIFEST_PATH /data/local/tmp/dummy_manifest.json

3. Then, example.com is shown in fullscreen (without address bar). That means PWA for example.com is injected.

4. Once inject the PWA, you can invoke through mozilla.components.feature.pwa.VIEW_PWA intent. Then, it runs again in fullsreen.

adb shell am start -a mozilla.components.feature.pwa.VIEW_PWA -d 'https://example.com/'

5. If you choose Delete browsing data from Setting menu, injected PWA can not be cleared.
   You need to remove all storage data of Fenix or re-install.

Comment 1

[Muneaki Nishimura]

Attachment: Demo

Comment 2

[:Gijs (he/him)]

Sebastian, are you the right person to look at this and bug 1657055 ? They look pretty serious.

Comment 3

[Sebastian Kaspari (:sebastian; :pocmo)]

I can take a look and if necessary find someone on the team to continue.

Comment 4

[Frederik Braun [:freddy]]

sec-moderate, I think this requires a "bad app", right?

Comment 5

[Muneaki Nishimura]

Yes, bad app is required so I agree with you!

Comment 6

[Sebastian Kaspari (:sebastian; :pocmo)]

Assigning this to Tiger who has agreed to take a look at this.

Comment 7

[Tiger Oakes]

I've got a PR ready in Fenix to validate the manifest location inside the app files before reading it. Is something like "validates manifest folder" obscure enough for a Fenix bug/PR title?

Comment 8

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

Is something like "validates manifest folder" obscure enough for a Fenix bug/PR title?

Yup that sounds fine. Thank you for picking this up to quickly.

Comment 9

[Tiger Oakes]

https://github.com/mozilla-mobile/fenix/issues/13357

Comment 10

[Frederik Braun [:freddy]]

Stefan, is Tiger still working on it? If not, can you please reassign. Thanks!

Comment 11

[Kevin Brosnan [Ex-Mozilla]]

Looks like this was merged in August https://github.com/mozilla-mobile/fenix/pull/13358

Comment 12

[Daniel Veditz [:dveditz]]

What version of Fenix did (will?) this ship in? We will need an advisory for it.

Comment 13

[Kevin Brosnan [Ex-Mozilla]]

Sebastian would you have a look? I was not able to see any behavior difference between 80.x and Nightly 83. Using the steps in comment 0 crashes with the display already required. If I kill the app between the two adb shell commands then it works.

Comment 14

[Sebastian Kaspari (:sebastian; :pocmo)]

In 80 I see us pick up the manifest and save it to disk for later and using the values from the manifest. In 83 the manifest gets rejected (since it is not in the expected location) and we launch in a "custom tab fallback mode" just loading the URL. So this looks good and as intended.

Along the way I found a possible crash (I used some invalid manifest) and opened a PR to catch parsing errors.

Using the steps in comment 0 crashes with the display already required.

I didn't run into this one. Maybe we can look at this outside of this bug. If we can extract some STRs for the "display already acquired" bug then this would be helpful for something else. :)

Comment 15

[Frederik Braun [:freddy]]

Attachment: advisory.txt

Comment 16

[Frederik Braun [:freddy]]

Attachment: advisory.txt

Comment 17

[Tom Ritter [:tjr]]

Attachment: advisory.txt