1730194 - (CVE-2021-38505) Prevent Copy button to send information to Cloud Clipboard and Clipboard History on Windows

Status: VERIFIED FIXED

(Firefox :: about:logins, defect, P1)

Description

[Sergey Galich [:serg]]

Windows 10 introduced Cloud Clipboard and Clipboard History, when app uses classic clipboard API the information goes to the local clipboard and to the cloud/history as well.

This is typically not clear or known to user, so they might not understand they are copying their sensitive information to the cloud and history.

There is no known way to disable these features for the whole app, but if we add 3 clipboard formats listed here https://docs.microsoft.com/en-us/windows/win32/dataxchg/clipboard-formats#cloud-clipboard-and-clipboard-history-formats we will prevent sensitive data from going to the unexpected places.

Comment 1

[Sam Foster [:sfoster] (he/him)]

Changing severity to S3 as this is existing functionality that continues to "work" but now with unexpected side-effects.
If the suggested clipboard formats solution in comment #0 will fix this, this should be a quick patch we can ship ASAP.

Comment 2

[Sergey Galich [:serg]]

Attachment: WIP: Bug 1730194 - Prevent Copy button to send information to Cloud Clipboard and Clipboard History on Windows

Comment 3

[Sergey Galich [:serg]]

WIP here prevents Copy button in about:logins from storing info in Cloud Clipboard and Clipboard History, as an added bonus it also prevents almost anything in Private Browsing from going to the clouds as well.

I'd appreciate a review and suggestions on how to move this forward.

Comment 4

[Sergey Galich [:serg]]

Attachment: Bug 1730194 - Prevent Copy button to send information to Cloud Clipboard and Clipboard History on Windows r?dimi,sfoster,tgiles,johannh

Comment 5

[Sergey Galich [:serg]]

Comment on attachment 9241572 [details]
Bug 1730194 - Prevent Copy button to send information to Cloud Clipboard and Clipboard History on Windows r?dimi,sfoster,tgiles,johannh

removed comment that was made by mistake

Comment 6

[Sergey Galich [:serg]]

Comment on attachment 9241572 [details]
Bug 1730194 - Prevent Copy button to send information to Cloud Clipboard and Clipboard History on Windows r?dimi,sfoster,tgiles,johannh

removed comment that was made by mistake

Comment 7

[Tom Ritter [:tjr]]

Comment on attachment 9241572 [details]
Bug 1730194 - Prevent Copy button to send information to Cloud Clipboard and Clipboard History on Windows r?dimi,sfoster,tgiles,johannh

Approved to land and request uplift

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Prevent Copy button to send information to Cloud Clipboard and Clipboard History on Windows r=dimi,johannh,cmartin
https://hg.mozilla.org/integration/autoland/rev/c13cadb3b0e0dc2fb2a0f0d0568ab671b738f7ad
https://hg.mozilla.org/mozilla-central/rev/c13cadb3b0e0

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Please nominate this for Beta & ESR91 approval when you get a chance.

Comment 10

[BugBot [:suhaib / :marco/ :calixte]]

As part of a security bug pattern analysis, we are requesting your help with a high level analysis of this bug. It is our hope to develop static analysis (or potentially runtime/dynamic analysis) in the future to identify classes of bugs.

Please visit this google form to reply.

Comment 11

[Sergey Galich [:serg]]

Comment on attachment 9241572 [details]
Bug 1730194 - Prevent Copy button to send information to Cloud Clipboard and Clipboard History on Windows r?dimi,sfoster,tgiles,johannh

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: Around 2018 Windows 10 added new places where information goes when it is sent to clipboard (cloud/history). This patch prevents leaking secrets to unexpected places.
• User impact if declined: Every Ctrl+C in Private Browsing and when will be going to the history/cloud. According to https://metadataconsulting.blogspot.com/2018/05/How-safe-secure-is-the-new-Microsoft-Cloud-Clipboard.html initially it was stored in plain text on disk.
• Fix Landed on Version: 94
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): changes are made in the rarely updated code (Clipboard) and we are adding extra "data formats" to mark sensitive data as sensitive.
• String or UUID changes made by this patch:

Beta/Release Uplift Approval Request

• User impact if declined: Every Ctrl+C in Private Browsing and when will be going to the history/cloud. According to https://metadataconsulting.blogspot.com/2018/05/How-safe-secure-is-the-new-Microsoft-Cloud-Clipboard.html initially it was stored in plain text on disk.
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: Ctrl+C anything from the web page in Private Browsing or click Copy button on password field in about:logins. Without this patch, Windows+V will show clipboard history with copied content, with this patch Clipboard history will not have copied content.
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): changes are made in the rarely updated code (Clipboard) and we are adding extra "data formats" to mark sensitive data as sensitive.
• String changes made/needed:

Comment 12

[Bogdan Maris, Desktop Test Engineering]

Reproduced the initial issue using old NIghtly from 2021-09-11, the copied text or password from about:logins are saved in the Clipboard. Verified that using latest Nightly build on Windows 10 this does not happen anymore, nothing is saved in the clipboard from Private Window or Private Mode.

Comment 13

[Dianna Smith [:diannaS]]

Comment on attachment 9241572 [details]
Bug 1730194 - Prevent Copy button to send information to Cloud Clipboard and Clipboard History on Windows r?dimi,sfoster,tgiles,johannh

Approved for 94.0b6

Comment 14

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/3ea4b88551a0

Comment 15

[Bogdan Maris, Desktop Test Engineering]

Also verified this is fixed using 94.0b6.

Comment 16

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9241572 [details]
Bug 1730194 - Prevent Copy button to send information to Cloud Clipboard and Clipboard History on Windows r?dimi,sfoster,tgiles,johannh

Approved for 91.3esr.

Comment 17

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr91/rev/8e2b9a337281

Comment 18

[Bogdan Maris, Desktop Test Engineering]

Also verified that this is fixed using latest esr91 build from treeherder.

Comment 19

[Tom Ritter [:tjr]]

Attachment: advisory.txt