1729161 - Saved password disclosure in mozilla firefox browser

Status: RESOLVED WONTFIX

(Toolkit :: Password Manager, defect)

Description

[gautammujjwal]

mozilla fire fox version - 91.0.2 (64-bit)

Reproduction steps

1. Click on 3 horizontal bar on the top right.
2. Click on passwords.
3. Click on "show password icon" beside copy button in the password field.

Comment 1

[gautammujjwal]

What is the attack scenario?

My friend using my laptop for short time, can view all my saved password without having to enter the computer password which is a very sensitive issue as all saved password will be disclosed.

What is impact?

UserB using the laptop of UserA for very short time gets access to all the saved password of the system in firefox browser. This is very sensitive issue.

What is the fix to this vulnerability?

When clicked on "Show password" icon, browsers like google chrome and microsoft edge asks to enter the laptop password before displaying the password. This is the fix to this sensitive vulnerabilty.

Comment 2

[Frederik Braun [:freddy]]

What you are describing is known and intended behavior. We recommend people who use shared devices to lock their accounts and use individual system accounts for each individual user.
If you further want to protect your passwords, you can encrypt and lock them using a Primary Password.

Thank you for reporting this bug to us, it will be ineligible for a bug bounty. If you want to know more, there are numerous duplicates filed for this finding.