1709257 - (CVE-2021-29965) Fenix password manager is fooled by origin of http auth prompt, suggests passwords for the completely wrong site

Status: RESOLVED FIXED

(Fenix :: General, defect)

Description

[Harshit Mahendra]

Attachment: Screenshot_20210428_182959_org.mozilla.firefox.jpg

+++ This bug was initially created as a clone of Bug #1708107 +++

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36
Firefox for Android

Steps to reproduce:

1. Open this URL - http://designs.ndev.xyz/test/new.html
2. Click on the 'Click here to Open Apple.com'.
3. Wait for 1 second.

Actual results:

POC videos -
Android - https://youtu.be/SbQMQt86KKw

As you can see in the screenshot the http auth is suggesting the password of apple.com

Expected results:

The Fenix password manager should NOT be suggesting passwords that don't match the source of the http auth.

Comment 1

[Harshit Mahendra]

Here I want to ask a question These password in the screenshot is saved on my google chrome Browser not in Firefox. but it is suggesting me on Firefox? if I click on the "manage password" it open the google chrome app and redirect me to the password manager.

Is this a bug of google or Firefox ?

Comment 2

[Johann Hofmann [:johannh]]

This seems specific to Android. Stefan, can your team take a look at this? Thanks!

Comment 3

[Daniel Veditz [:dveditz]]

This looks to me like an extension/consequence of bug 1708107 -- we've spoofed our own password manager!

Note: we intentionally suggest passwords for sibling domains because that comes up a lot in large sites (e.g. sites where the password is saved for registration.veditz.example and then used on www.veditz.example). THIS IS NOT THAT. We're suggesting passwords based on the URL of the topmost tab while the auth comes from a different tab entirely.

Are we equally wrong if the auth prompt comes from a cross-origin frame?

Comment 4

[Daniel Veditz [:dveditz]]

The popup from behind is probably a Gecko bug, and a spoofing problem in its own right: bug 873810

THIS bug (with a higher severity) is that our password manager suggestions lend credence to the spoof and make it much more likely the user will fall for it.

Comment 5

[Sebastian Kaspari (:sebastian; :pocmo)]

I'll take a look.

From the video it seems like what happens:

• The http auth dialog is shown for the previous page. (Not getting cancelled on navigation?) [Edit: That assumption was wrong, the dialog is for the next page that should get loaded]
• Autofill suggestions are shown for the current page. What's interesting here is that this doesn't seem to be our own suggestions, but come from Android's Autofill API (which is also confirmed by the user seeing suggestions from their accounts stored in Chrome). I'm curious whether we pass the domain along or whether the Autofill service tries to interpolate it from the view structure.

Comment 6

[Sebastian Kaspari (:sebastian; :pocmo)]

Attachment: 0001-AuthenticationDialogFragment-Use-URL-from-prompt-req.patch

The password suggestions are coming from the system's autofill provider (Android system API).

We try to give the system API a hint and tell it the domain to autofill for:
https://github.com/mozilla-mobile/android-components/blob/master/components/feature/prompts/src/main/java/mozilla/components/feature/prompts/dialog/AutofillEditText.kt

Unfortunately we pass along the URL of the current tab:
https://github.com/mozilla-mobile/android-components/blob/master/components/feature/prompts/src/main/java/mozilla/components/feature/prompts/PromptFeature.kt#L610

With this patch, we pass the URL the auth dialog is for instead (that we get from Gecko).

Comment 7

[Sebastian Kaspari (:sebastian; :pocmo)]

Attachment: 0001-AuthenticationDialogFragment-Use-URL-from-prompt-req.patch

Comment 8

[Christian Sadilek [:csadilek]]

Comment on attachment 9222615 [details] [diff] [review]
0001-AuthenticationDialogFragment-Use-URL-from-prompt-req.patch

Review of attachment 9222615 [details] [diff] [review]:
-----------------------------------------------------------------

Tested this patch against the provided sample page and verified that only logins matching the domain of the auth request are suggested.

Comment 9

[Sebastian Kaspari (:sebastian; :pocmo)]

Comment on attachment 9222615 [details] [diff] [review]
0001-AuthenticationDialogFragment-Use-URL-from-prompt-req.patch

Security Approval Request

• How easily could an exploit be constructed based on the patch?: The patch exposes that we have been using the current page's URL for the autofill hint instead of the URL the auth dialog is for. With that information you may end up figuring out the spoofing shown in this bug.

However to be effective it needs: An Android device supporting the autofill API (Android 8+), the user to have setup an autofill provider (or using the default), the user having matching accounts stored in the autofill provider.

• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: Unknown
• Which older supported branches are affected by this flaw?: All release versions of Firefox for Android
• If not all supported branches, which bug introduced the flaw?: None
• Do you have backports for the affected branches?: Yes
• If not, how different, hard to create, and risky will they be?:
• How likely is this patch to cause regressions; how much testing does it need?: Very unlikely.

Comment 10

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Comment on attachment 9222615 [details] [diff] [review]
0001-AuthenticationDialogFragment-Use-URL-from-prompt-req.patch

We're in RC week, approved to land

Comment 11

[Daniel Veditz [:dveditz]]

Adding bounty nomination at the request of the reporter (email to security@)

Comment 12

[Sebastian Kaspari (:sebastian; :pocmo)]

• Patch landed in the branches A-C and Fenix Nightly.
• And patch landed in the A-C and Fenix branches for Fenix 89 (waiting for the next Beta/RC to get out).

Comment 13

[Harshit Mahendra]

:pocmo Thanks for fixing this bug. I checked on Firefox Nightly and It's working fine.

:dveditz Does this bug qualify for bounty ? let me know.

Thanks,
Harshit Mahendra

Comment 14

[Frederik Braun [:freddy]]

Attachment: advisory.txt

Comment 15

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

The bug is flagged for the bounty committee and we will evaluate it in the coming weeks (probably next week.)

Comment 16

[Harshit Mahendra]

:dveditz Thanks for the bounty ! Just wanted to ask what will be the next step to process bounty ?

Comment 17

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Harshit - I will be doing the paperwork on our end and emailing you