1764723 - Bypass moderation check when posting images or links to external domain in support.mozilla.org

Status: RESOLVED WONTFIX

(support.mozilla.org :: General, defect)

Description

[haxatron1]

Typically, users messages have to undergo moderation when they post images to external domain.

But, it is possible to bypass this check by using double back slash, which signify a protocol relative URI. (see https://en.wikipedia.org/wiki/Wikipedia:Protocol-relative_URL#:~:text=A%20protocol%2Drelative%20URL%20(PRURL,t%20support%20HTTPS%20at%20all.)

Payload:

<img src="\example.com">

Will cause requests to example.com (external domain)

As such, it is possible to bypass the moderation entirely and post a broken image to external domain. This can be abused by attackers to collect IP address information from users.

Comment 1

[haxatron1]

<img src="\\example.com">

Comment 2

[haxatron1]

Yea sorry it should be

<img src="\\example.com">

The bugzilla form escaped some of my backtick characters

Comment 3

[Frida K [:frida]]

Hello,

Thank you for your report.

I can confirm that the HTML with <img src="\\example.com"> in the comment bypassed moderation.

Thanks,
Frida

Comment 4

[haxatron1]

On further analysis, I found out that <img src="http://example.com"> also works, the reason why the link filter is not picking up the external URL is because it is bugging out when there is a " at the end

For example, posting the link http://example.com in plaintext will flag your comment for moderation

but posting http://example.com" will defeat the allow-list link filter and cause it to render as a link.

Comment 5

[Frida K [:frida]]

Hello Tasos,

Can you please check this report? It is possible to bypass moderation by using \\example.com as the URL.

Thanks,
Frida

Comment 6

[Tasos Katsoulas [:tasos]]

The regex to moderate links was never designed as a solution to block all links but rather as a measure to discourage people to post external links. Even if a link passes though, CSP will block any XSS attempt here. Because of these reasons, I am leaning towards marking this bug as WONTFIX. Please reopen if I misunderstood something here.