1725626 - Strip "javascript:" scheme when pasting/dropping into the address bar to prevent socially engineered self-XSS

Status: RESOLVED FIXED

(Fenix :: Toolbar, defect)

Description

[sharan]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36

Steps to reproduce:

Self UXSS have been identified in firefox andriod browser
,Normally while pasting javascript:URI in firefox desktop URLBAR/OMNIBOX the Javascript word is removed and also if we type also the XSS won't happen
.But in andriod browser it can be pasted and xss can done

1.Go to any website in firefox
2.Pase the url Javascript:alert(1) or Javascript:alert(document.cookie)

Actual results:

SELF UXSS

Expected results:

SELF UXSS

Comment 1

[sharan]

Any update?

Comment 2

[Daniel Veditz [:dveditz]]

Can confirm.

When fixing watch out for various attempts to bypass naïve matching like bug 1402896 and bug 1439396 (for one, be careful about normalizing before matching). Don't forget about drag-and-drop if that goes through a different path than pasting.

Same problem in Focus. It's a different implementation so I'll clone this bug.

Comment 3

[sharan]

Yes this same issue exist in focus.

Comment 4

[sharan]

In focus this issue has been fixed,Any updates about fix on firefox andriod browser?

Comment 5

[sharan]

Attachment: POC

Comment 6

[sharan]

WHAT'S THE UPDATE ON THIS??

Comment 7

[sharan]

Comment on attachment 9238550 [details]
POC

ISSUE POC FOCUS: https://drive.google.com/file/d/1GuGbG9xrra6BXHPwMtgz8g-uTiO-6bsV/view?usp=drivesdk

Comment 8

[sharan]

ISSUE POC IN FIREFOX:https://drive.google.com/file/d/1EbEaA1DmJTLCfrpqf6RjZR1tvmok-ZA2/view?usp=sharing

Comment 9

[Daniel Veditz [:dveditz]]

This has not been fixed in Focus, see bug 1726050 comment 1

Comment 10

[sharan]

Sorry for the confusion,This has not been fixed in Focus

Comment 11

[sharan]

Any update on fix?

Comment 12

[sharan]

hey any updates regarding this??

Comment 13

[Kevin Brosnan [Ex-Mozilla]]

This was resolved this by disallowing javascript URIs that the user entered. https://github.com/mozilla-mobile/android-components/pull/11321 and https://github.com/mozilla-mobile/android-components/blob/main/components/browser/engine-gecko/src/main/java/mozilla/components/browser/engine/gecko/GeckoEngineSession.kt#L1114

Comment 14

[sharan]

will i get hall of fame or bounty for this submission ?

Comment 15

[sharan]

will i get hall of fame or bounty for this submission ?

Comment 16

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

I've added the bounty flag so it will be considered in our next meeting.

Comment 17

[sharan]

Fine ,Can i know what is bounty flag.

Regards
Sharan

Comment 18

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

The bounty flag indicates the status of a bounty; once a bounty is approved or decline it will be changed to + (plus, approved) or - (minus, declined). Right now it's set to '?' so it will show up in our query of 'issues to evaluate' at our next bounty meeting. If a bounty is approved the flag will be changed, and 1-5 days later I'll email you with details about how payment occurs, which typically takes 3-5 weeks from a bounty being approved.

Comment 19

[sharan]

Fine.

Comment 20

[Daniel Veditz [:dveditz]]

Same problem in Focus. It's a different implementation so I'll clone this bug.

This turned out to be incorrect: it was not in the front-end UX code as I guessed but in the shared Android Components.

This bug is not eligible for a cash bounty but it is eligible for a Hall of Fame listing.

Comment 21

[sharan]

I don't know how you are saying this is not security bug.

Yes ,this attack need a minimal socail engineering but we can't say this as non security bug.

For attack scenario
the victim need to paste this in the url bar and need to send some sort of img i.e screenshot as [social engineering]to the attacker.

Comment 22

[sharan]

soecurity bug security bug

Comment 23

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

We did not say it wasn't a security bug; it is. But as described in our bug bounty policy vulnerabilities rated moderate or below are not guaranteed a bounty. Because of the level of user interaction required (especially on mobile where it's much more annoying to copy/paste) it was rated sec-low and did not qualify for a bounty; however we will include you in the Hall of Fame.

Comment 24

[sharan]

No the copy paste in mobile can be quiet easy too .
see this

An easy effortless scenario:
likely victim can easily copy in website where easy html /JS copy function i.e click /tap to copy and Victim can easily copy via keyboard clipboard.

https://drive.google.com/file/d/1qxCZk_9AZQS6mTJsSLcaGjuvAAl-V0Sw/view?usp=drivesdk

Comment 25

[sharan]

https://drive.google.com/file/d/1qxCZk_9AZQS6mTJsSLcaGjuvAAl-V0Sw/view?usp=drivesdk
SEE THIS
https://drive.google.com/file/d/1rE-zJe_7mDZCG3mzI9WVDiaHnSmsJJnL/view

Comment 27

[sharan]

Your comments on this?

"No the copy paste in mobile can be quiet easy too .
see this

An easy effortless scenario:
likely victim can easily copy in website where easy html /JS copy function i.e click /tap to copy and Victim can easily copy via keyboard clipboard.

https://drive.google.com/file/d/1rE-zJe_7mDZCG3mzI9WVDiaHnSmsJJnL/view
"

Comment 28

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

We discussed it again, but we haven't changed our decision

Comment 29

[sharan]

i don't know why you have not change your decision.

Comment 30

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

We reconsidered the submission but it still does not meet the criteria to receive a bounty. Please do not continue to ask.

Comment 31

[sharan]

i do know this is low severity bug.
lastly you only stated that this
" on mobile where it's much more annoying to copy/paste."
So i thought for this reason only this doesn't meet at least a low level severity .

As reporter if i know the reason for decision only , i can avoid reporting this kind of issue.

Even i don't want to waste my time here.

Comment 32

[Daniel Veditz [:dveditz]]

Bugs are for bug (defect) information; if you want to discuss bounty stuff please don't bother the developers (here in this bug) with it but mail the address given for our Bug Bounty program. You also may find the FAQ answers many of your questions. The program is directed primarily to stimulate research into finding bugs such as memory corruption that can lead to browser or even computer compromise ("0-days").

Please honor our Bugzilla participation rules