1770227 - NotificationDB.sys.mjs does not perform origin checks on received messages

Status: NEW

(Core :: DOM: Notifications, defect)

Description

[Tom Ritter [:tjr]]

This would allow a rogue content process to forge Notifications from another domain, which could be used for phishing-type attacks.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:tspurway, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 2

[Tim Spurway [:tspurway]]

:mardak, could you take a quick look at this - it sounds a bit sinister

Comment 3

[Ed Lee :Mardak]

gerard-majax, do you recall if origin checks weren't necessary for some of these messages?

Comment 4

[:gerard-majax]

I see two NotificationDB.jsm, which one are we talking about ?

Comment 5

[Andrew McCreight [:mccr8]]

This probably applies to both the old and new implementation (new is used on Nightly, old is used on other branches).

Comment 6

[:gerard-majax]

(In reply to Ed Lee :Mardak from comment #3)

gerard-majax, do you recall if origin checks weren't necessary for some of these messages?

I'm sorry, but this is code that was already there, and I really have no memory of that specific point. Is it possible this is code that back then was only exposed through privileged APIs and not to general content, and this we did not really had to care?

Comment 7

[Andrew McCreight [:mccr8]]

This code has only ever been exposed through privileged APIs. The concern is about privilege escalation when a content process gets taken over by a hostile website. eg if you visit evil dot com and that website manages to use an exploit to take over the child process, we don't want it to be able to start pushing out things that look like Gmail notifications.

Comment 8

[:gerard-majax]

(In reply to Andrew McCreight [:mccr8] from comment #7)

This code has only ever been exposed through privileged APIs. The concern is about privilege escalation when a content process gets taken over by a hostile website. eg if you visit evil dot com and that website manages to use an exploit to take over the child process, we don't want it to be able to start pushing out things that look like Gmail notifications.

My point being, I have no memory of specifically having to work on the origin part, so I really dont remember anything specific about it. The only memory I have about it is being used for indexing in the database, and so I assume we expected code calling us to have done the checks.

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:tspurway, could you have a look please?

For more information, please visit auto_nag documentation.