1714220 - Hijack Service Worker using Extension

Status: RESOLVED DUPLICATE of bug 1636629

(WebExtensions :: Request Handling, enhancement)

Description

[Karthika]

Attachment: ExtensonHijack.zip

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36

Steps to reproduce:

Hi,

We have found that Firefox extensions could be used to modify the content of a Service Worker script at the time of its registration. To perform this operation, an extension only requires commonly used "webRequest" and "webRequestBlocking" permissions. If these permissions are granted, the extension could then use "filterResponseData" API to read and modify the content of a SW request/response.

This may have security implications. For example, a malicious extension could exploit this functionality and inject malicious code in legitimate service workers (SWs) that are registered from any origin. Such injected code may then become "permanent" in the user's machine even if the malicious extension is removed by the user or purged by the extension store. Since SWs have access to all network requests/responses related to their corresponding origins, the code injected by the extension may be used to leak sensitive user information to an attacker.
To demonstrate this attack, we developed a proof-of-concept extension that modifies the content of SWs when a website tries to first register it. In order to ensure that SW auto-update doesn't overwrite the code injected by the extension, we also modify the content of any script imported by the SW, since imported scripts are rarely updated and thus can make malicious code more persistent.
Please find attached the proof-of-concept extension files.

Steps to reproduce the issue:

1. Install the provided extension.
2. Visit a page that registers a legitimate SW for the first time (e.g. https://gauntface.github.io/simple-push-demo).
3. Inspect the SW code from "about:debugging#/runtime/this-firefox" and notice the code added to the beginning of the SW file. Obviously, a real malicious extension could add any arbitrary code intended to accomplish a specific malicious goal.

Tested Version : Firefox Desktop v88.0.1

Comment 1

[Karthika]

The issue was tested on version 89.0 as well.

Comment 2

[Rob Wu [:robwu]]

Thanks for your bug report and STR. This is a known issue and being worked on in bug 1636629.

Comment 3

[Karthika]

Thanks for the response.