1731779 - (CVE-2021-38510) download protection bypass on macOS with .inetloc

Status: VERIFIED FIXED

(Firefox :: File Handling, defect, P1)

Description

[houjingyi647]

Attachment: test.inetloc

firefox Version: 92.0
Operating System: macOS Big Sur, 11.5.2

Vladimir Metnew reported that .fileloc files on macOS can bypass download protection in 2019:https://bugzilla.mozilla.org/show_bug.cgi?id=1596668
However, .inetloc files are similar to .fileloc files and .inetloc is not in blacklist.
When open a .fileloc file in firefox, firefox will warn:" 'test.fileloc' is an executable file. Executable files may contain viruses or other malicious code that could harm your computer. Use caution when opening this file. Are you sure you want to launch 'test.fileloc'? "
But when open a .inetloc file in firefox there is no warning and attacker may execute arbitrary commands.
I provided a test.inetloc which can open calc for test.

Comment 1

[houjingyi647]

https://drive.google.com/drive/folders/1HW7iHrsBeL3J-ACt9mm2Ct13qXN1PrCk?usp=sharing

I also recorded a video and you can see how fiefox handle .inetloc and .fileloc differently.

Comment 2

[:Gijs (he/him)]

This is only a thing because Apple didn't lowercase file:// before doing their checks on inetloc files, right? (cf. https://www.tomsguide.com/uk/news/macos-finder-inetloc-flaw )

That doesn't seem like something for which we should add warnings to all inetloc files now; it'd just be a patch race between us and Apple - but adding this executable warning to the file would be inaccurate in the vast majority of cases (ie non-file:// inetloc files) and isn't that likely to help protect users (if they were gonna click on it anyway...), and only appears if opened from Firefox (not if opened from Finder or other applications). So my impression is that Firefox is not the right place to fix this issue. Dan?

Comment 3

[Daniel Veditz [:dveditz]]

Clearly Apple doesn't intend this behavior because they do block lowercase file://, but warning would be both not enough and not always correct.

On the other hand this is a strange file type to be asking someone to download so maybe warning "too much" isn't all that bad? We do treat both .lnk and .url files on Windows as executables, and this file type seems to function like .url files.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:Gijs, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 5

[:Gijs (he/him)]

Attachment: Bug 1731779 - r?dveditz!,dimi!

Comment 6

[:Gijs (he/him)]

Comment on attachment 9245224 [details]
Bug 1731779 - r?dveditz!,dimi!

Beta/Release Uplift Approval Request

• User impact if declined: Potential for security risk through inetloc
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: See comment 0
• List of other uplifts needed: n/a
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): We're just adding the extension to a bunch of lists, and updating tests accordingly.
• String changes made/needed: Nope

Comment 7

[:Gijs (he/him)]

https://hg.mozilla.org/integration/autoland/rev/2b186723942d

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/2b186723942d

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9245224 [details]
Bug 1731779 - r?dveditz!,dimi!

Approved for 94.0b9 and 91.3esr.

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/c776815b4f53

Comment 11

[Dianna Smith [:diannaS]]

https://hg.mozilla.org/releases/mozilla-esr91/rev/7d4e4d060f57

Comment 12

[Bogdan Maris, Desktop QA]

Reproduced the reported issue as of comment 0 using Firefox 92.0, verified that the Warning message is successfully displayed when downloading the attached testcase using Firefox 94.0b9, latest Nightly 95.0a1 and latest 91 ESR build from treeherder.

Comment 13

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Attachment: advisory.txt

Comment 14

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Attachment: advisory.txt

Comment 15

[houjingyi647]

Hello, could you please acknowledge me as "Hou JingYi (@hjy79425575)" instead of "houjingyi647"? Thank you!

Comment 16

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

I've updated the advisories and in the HoF we'll include the link to your twitter account.