1737751 - (CVE-2021-43546) users with zoomed cursors vulnerable to spoofed cursors leaking into the addressbar

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Daniel Veditz [:dveditz]]

+++ This bug was initially created as a clone of Bug #1670316 +++

The defense against large spoofed cursors leaking into the browser chrome does not take into account that users may have increased the size of their OS cursor for accessibility reasons. See bug 1670316 comment 30 and following.

On Mac you can do this by searching for "cursor size" in system preferences and making the cursor larger than normal. You may need to restart Firefox to see the spoof. Then try any of the testcases previously used for this issue. If we can detect that the OS is scaling the cursor larger, we should adjust the point at which we kill a custom cursor accordingly.

POCs:

• https://jameshfisher.github.io/cursory-hack/
• https://benjaminbenben.com/cursory-hack/

I'm lowering the security severity of this since it won't apply by default for most users.

Comment 1

[Emilio Cobos Álvarez (:emilio)]

So I looked a bit through the Apple docs and I don't see any obvious way to query the OS cursor magnification factor... Stephen, do you know if I might have overlooked it?

Without it we can't really make a lot of progress on this bug I think.

Comment 2

[Jonathan Kew [:jfkthame]]

I think you want to look at the preferences value mouseDriverCursorSize from the domain com.apple.universalaccess, which is a floating-point value giving the magnification factor in use.

So we should be able to use something like CFPreferencesCopyAppValue or NSUserDefaults APIs to read it and apply the appropriate scaling.

Comment 3

[Jonathan Kew [:jfkthame]]

Attachment: Bug 1737751 - Account for macOS cursor scaling. r?emilio

Comment 4

[Jonathan Kew [:jfkthame]]

Something like this seems to basically work, with the caveat that it doesn't seem to account for on-the-fly changes to cursor scaling; if I change the scale in System Preferences, I have to relaunch the browser to properly see the effect. But I don't suppose that matters very much.

Comment 5

[Daniel Veditz [:dveditz]]

Apparently it's not just OS scaling, and not just mac. See bug 1737722

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Account for macOS cursor scaling. r=emilio
https://hg.mozilla.org/integration/autoland/rev/044695f562052e00a3dc7c565290df3b4d420749
https://hg.mozilla.org/mozilla-central/rev/044695f56205

Comment 7

[Jonathan Kew [:jfkthame]]

Comment on attachment 9247781 [details]
Bug 1737751 - Account for macOS cursor scaling. r?emilio

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: Possible to mislead the user by spoofing visible cursor position, including appearing to be in browser chrome but in fact clicking within page content.
• User impact if declined: Mac users with scaled cursor size could be subject to spoofing.
• Fix Landed on Version: 95
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Localized patch with simple correction to coordinate arithmetic; no-op except for Mac users with cursor scaling enabled.
• String or UUID changes made by this patch:

Comment 8

[Alexandru Trif, Desktop Test Engineering [:atrif]]

Reproduced the issue with Firefox 95.0a1 (2021-10-26) on macOS 10.15 using attached tc's from comment 0 and STR. The custom cursor is exiting the Firefox window if the cursor size is changed from macOS preferences.
The issue is fixed with Firefox 95.0b5 (20211109194756) on macOS 10.15. After changing the cursor size and restarting Firefox, the custom cursor is no longer exiting the Firefox window. Per comment 4 the need to restart Firefox for this fix to work is a known issue.

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9247781 [details]
Bug 1737751 - Account for macOS cursor scaling. r?emilio

Approved for 91.4esr.

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr91/rev/ba9ee45df167

Comment 11

[Alexandru Trif, Desktop Test Engineering [:atrif]]

Verified fixed with Firefox 91.4.0esr (20211111045525) on macOS 10.15. The cursor is no longer exiting the Firefox window if the cursor size is increased and the browser is restarted.

Comment 12

[Frederik Braun [:freddy]]

Attachment: advisory.txt