1716129 - (CVE-2021-29987) Moving Permission Panel with Click Still Registered in Default Position on GTK

Status: VERIFIED FIXED

(Core :: Widget: Gtk, defect)

Description

[Irvan Kurniawan (:sourc7)]

Attachment: moving-permission-panel.html

After request multiple permission at the same time, then after first interaction to the permission panel, the second permission panel will moving to another position with click button still registered on default position, which lead user unintentionally click "Allow" on the permission button.

I noticed it currently affects Linux distributions that use KDE as the desktop environment:

• Kubuntu
• openSUSE
• KDE Neon
• Fedora KDE
• Manjaro KDE

When using mozregression the permission panel is moving out after checkout to commit Notification anchors are not hidden when the user types in the location bar.

Tested on:

• Arch Linux with KDE as default Desktop Environment
• Kubuntu 21.04 on VM

Steps to reproduce:

1. Open Firefox on KDE (desktop environment)
2. Visit attached moving-permission-panel.html
3. When first permission dialog appear then press 'esc'
4. The second permission dialog will appear on another position with click still registered on original doorhanger position
5. Click on "Click to Continue" button
6. Microphone or geolocation permission is now allowed

Comment 1

[Irvan Kurniawan (:sourc7)]

Attachment: Firefox Moving Permission Panel - Arch Linux.mp4

Comment 2

[Irvan Kurniawan (:sourc7)]

Attachment: Firefox Moving Permission Panel - Kubuntu.mp4

Comment 3

[Daniel Veditz [:dveditz]]

Not seeing an issue on MacOS. Tyson sees a different positional weirdness on Gnome (only some of the time when he reloads) where the second permission panel shows up near the bottom of the screen rather than where it should.

Weirdly these look like pure "Firefox-styled" panels, they aren't OS widgets so why would the OS change the behavior?

gcp: do you know who works on platform widgets/drawing these days?

Comment 4

[Gian-Carlo Pascutto [:gcp]]

Oof, this is tricky. Most of out Linux platform widget work is done by Red Hat these days. But they ship GNOME, not KDE, so not sure how reasonable it is to ask them.

Tyson sees a different positional weirdness on Gnome (only some of the time when he reloads) where the second permission panel shows up near the bottom of the screen rather than where it should.

Oh, okay, if we have STR on GNOME then stransky might be able to investigate.

Comment 5

[Martin Stránský [:stransky] (ni? me)]

Yes, I can reproduce it on Gnome too but in X11 mode only. I expect we use wrong popup parent / anchor so relative popup coordinates are wrong.

Comment 6

[Martin Stránský [:stransky] (ni? me)]

This is a good old bug when gtk widget is not positioned when it's hidden. Will post a patch for it.

Comment 7

[Martin Stránský [:stransky] (ni? me)]

Attachment: Bug 1716129 [Linux/X11] Reposition GtkWindow when it's shown, r?jhorak

Gtk on X11 tends to ignore widget position change requests when widget is not shown. Save the position requests when window is hidden and
apply that when it's shown.

Comment 8

[Martin Stránský [:stransky] (ni? me)]

I don't think this needs to be a security bug.

Comment 9

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

[Linux/X11] Reposition GtkWindow when it's shown, r=jhorak
https://hg.mozilla.org/integration/autoland/rev/1c3ed5c950ca0743b5c1d02efcda0f867e6cc4c4
https://hg.mozilla.org/mozilla-central/rev/1c3ed5c950ca

Comment 10

[Irvan Kurniawan (:sourc7)]

Attachment: Firefox Moving Permission Panel - Ubuntu.mp4

(In reply to Daniel Veditz [:dveditz] from comment #3)

Not seeing an issue on MacOS. Tyson sees a different positional weirdness on Gnome (only some of the time when he reloads) where the second permission panel shows up near the bottom of the screen rather than where it should.

It turns out I can also reproduce this on Ubuntu 20.04.2 LTS, the permissions panel moves to the bottom of the screen (as in the attached video) and it works every time after interacting with first permission request, and at some point the first permissions panel moves down automatically without any interaction to the panel.

Comment 11

[Irvan Kurniawan (:sourc7)]

(In reply to Martin Stránský [:stransky] (ni? me) from comment #8)

I don't think this needs to be a security bug.

In this case the
(In reply to Martin Stránský [:stransky] (ni? me) from comment #7)

Created attachment 9227852 [details]
Bug 1716129 [Linux/X11] Reposition GtkWindow when it's shown, r?jhorak

Gtk on X11 tends to ignore widget position change requests when widget is not shown. Save the position requests when window is hidden and
apply that when it's shown.

Comment 12

[Irvan Kurniawan (:sourc7)]

(In reply to Martin Stránský [:stransky] (ni? me) from comment #8)

I don't think this needs to be a security bug.

In this case the when permission panel is moving the click position still registered on default position, which leads malicious websites able to trick the user to click "Allow" on the permission panel without the user realizing that click HTML5 button will also click "Allow" on the permission panel (i.e allow camera, microphone, and geolocation) (as on attached video above).

(In reply to Martin Stránský [:stransky] (ni? me) from comment #7)

Created attachment 9227852 [details]
Bug 1716129 [Linux/X11] Reposition GtkWindow when it's shown, r?jhorak

Gtk on X11 tends to ignore widget position change requests when widget is not shown. Save the position requests when window is hidden and
apply that when it's shown.

Thank you for the patch, I confirmed it fixed the issue on Arch Linux with KDE and Ubuntu 20.04.2 LTS on Firefox Nightly 91.0a1 (2021-06-20) (64-bit).

Comment 13

[Tom Ritter [:tjr] (OOTO until mid-August)]

Attachment: advisory.txt