1715785 - Redirect Chain leaks to Content Process

Status: RESOLVED FIXED

(Core :: Networking, defect, P3)

Description

[Tom Ritter [:tjr]]

Presently when following a redirect chain we include the redirect chain in the LoadInfo which we send to the final Content Process. This type of behavior can leak to user credential theft via leaked OAuth tokens.

This bug report is a sample of one such vulnerability - this bug report didn't involve Spectre, the tokens were leaked to the attacker site in the Referer header. But considering a Spectre attacker, we could expose the tokens in an otherwise-secure flow because the redirect chain is in memory.

Is the redirect chain needed in the Content Process? Can we merely omit it there?

Comment 1

[(inactive) Nihanth Subramanya [:nhnt11]]

Thanks Tom - it seems like consumers of RedirectChain would need to modify their code to support this, but it does look generally possible.

Marking P3 since most consumers are outside of netwerk/
Do you mind setting a Severity here based on your assessment of the likelihood of exposure and the impact should an exposure arise?

Comment 2

[Tom Ritter [:tjr]]

We discussed this and consider it a blocker for disabling Spectre mitigations.

At a minimum we think the redirect chain should be redirect chain should be trimmed to just principals or something to that effect; but ideally we could exclude it from the content process?

Comment 3

[Dragana Damjanovic [:dragana]]

Christoph, can someone on your team take a look at this. Do you know if you need this information on the content process.

Note: Necko only provides this to the content process but does not consume the information. We can easily remove this from the content process if it is not needed. I also see this we can easily transform that into a flag and calculate it on the parent process.

Comment 4

[Christoph Kerschbaumer [:ckerschb]]

June, can you please take a look? I can provide some guidance on fixing this.

Comment 5

[June Wilde (she/her) [:jewilde]]

I'm on it!
I'm planning on picking this up when we return from the holidays in January.

Comment 6

[June Wilde (she/her) [:jewilde]]

Attachment: Bug 1715785 - Trim redirect chain of excess information; r=ckerschb

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/3c57d2b2f29d
Trim redirect chain of excess information; r=necko-reviewers,ckerschb,tjr,dragana

Comment 8

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/3c57d2b2f29d