1684627 - (CVE-2021-23976) Any websites can run with PWA privileges on Fenix (bypassing fix of Bug 1657026)

Status: RESOLVED FIXED

(Fenix :: General, defect)

Description

[Muneaki Nishimura]

Bug 1657026 can still be reproduced on the latest Fenix Nightly (retested it today).

As a countermeasure of Bug 1657026, a function isUnderFennecManifestDirectory was introduced for verifying given manifest directory is under <filesDir>/mozilla/<profile>/manifests/ (see below).
https://github.com/mozilla-mobile/fenix/blob/faf765a57d78be91deed9ed9ef54d24f31075192/app/src/main/java/org/mozilla/fenix/customtabs/FennecWebAppIntentProcessor.kt#L130

But the verification logic seems incorrect.

Here, if an attacker gives wrong manifest path such as /data/local/tmp/dummy_manifest.json, manifestsDir.name != "manifests" returns true, but true means that given manifest path is under the expected directory.

return manifestsDir == null || manifestsDir.name != "manifests" ||
    // Check that the folder two levels up is named "mozilla"
    manifestsDir.parentFile?.parentFile != getMozillaDirectory()

It seems this comparison part should be changed like below.

return manifestsDir == null || (manifestsDir.name == "manifests" &&
        // Check that the folder two levels up is named "mozilla"
        manifestsDir.parentFile?.parentFile == getMozillaDirectory())

Sorry for the delay in discovering the mistake.

Comment 1

[:Gijs (he/him)]

Sebastian, can you take a look when you're back? Thanks!

Comment 2

[Sebastian Kaspari (:sebastian; :pocmo)]

I'll take a look.

Comment 3

[Sebastian Kaspari (:sebastian; :pocmo)]

PR: https://github.com/mozilla-mobile/fenix/pull/17495

Comment 4

[Sebastian Kaspari (:sebastian; :pocmo)]

Patch landed in Fenix Nightly and should go out with the 86 train.

Comment 5

[Tom Ritter [:tjr]]

Attachment: advisory.txt