1773732 - Infinite loop within js::SetPrototype

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P2)

Description

[Syahri Ramadan]

1. open the browser (chrome, firefox, ms edge)
2. go to https://www.w3schools.com/html/tryit.asp?filename=tryhtml_basic
3. create the code in w3schools, jsfiddle, or codepen io
4. run the code in w3schools, jsfiddle, and codepen io in chrome, firefox, and ms edge
5. after you run the code, firefox is having problems like DOS attack

Comment 1

[Syahri Ramadan]

POC: https://drive.google.com/file/d/1I7aLCcJpYNV9GJqQTgPVQUhblFP-Mhig/view?usp=sharing

Comment 2

[Syahri Ramadan]

Attachment: UXSS via Prototype.html

Comment 4

[Andrew McCreight [:mccr8]]

It looks like the attachment is copied from a Project Zero report against WebKit, except that the "Tested on Safari" part was changed to "Tested on Firefox 101.0.1 (64-bit)."

Comment 5

[Andrew McCreight [:mccr8]]

The link in comment 1 is a video showing the test case being used in a number of browsers, including Chrome, Edge and Firefox. The Firefox part starts around 58 seconds into the video.

Comment 6

[Syahri Ramadan]

when the code is run in firefox, the firefox browser can't run properly like in ms edge and chrome

Comment 7

[Syahri Ramadan]

POC: https://drive.google.com/file/d/1ady8eolKNbvMEP8jipOQs3Aa0CmYiUo9/view?usp=sharing

Comment 8

[Syahri Ramadan]

Attachment: firefox.jpg

Comment 9

[Syahri Ramadan]

Attachment: firefox 1.jpg

Comment 10

[Syahri Ramadan]

both browsers run the same code on the same web, it can be seen that chrome browser contains more tabs than firefox.

Comment 11

[Syahri Ramadan]

I explored the existing code myself, and that's what happens in the firefox browser when the code is run

Comment 12

[Syahri Ramadan]

Hello, no update on this?

Comment 13

[Nicolas B. Pierron [:nbp]]

So far I was not able to prove or disprove any UXSS as this might be the case in other browsers.
The first alert message prints the location of the attacking page, and not the location of the attacked page.

Then the alert message creates a stacked event loops, in which the second onload is being executed.
Within the second onload call, the construct builtin is called, which spin iteratively in js::SetPrototype.

The browser appear stuck in this single function call. The tab can be closed, only the child process is unresponsive.

https://share.firefox.dev/3aRjtB5

Jan, are you the right person to investigate this issue?

Comment 14

[Syahri Ramadan]

I mean, of the three browsers I used in the video.
Only firefox crashes and can't run properly.
That's why I made this report.

Comment 15

[Jan de Mooij [:jandem]]

The problem is that RemoteObjectProxyBase::getPrototypeIfOrdinary returns isOrdinary = true but doesn't set the proto outparam to null, so we don't change it and always iloop. This should be the only call site and this isn't security sensitive.

Comment 16

[Syahri Ramadan]

So this is just a firefox feature?
Which eats up to 100% cpu performance

Comment 17

[Jan de Mooij [:jandem]]

Attachment: Bug 1773732 - Set proto outparam in RemoteObjectProxyBase::getPrototypeIfOrdinary. r?peterv!

This prevents us from ilooping in SetPrototype.

Comment 18

[Daniel Veditz [:dveditz]]

Denial of Service bugs (simply crashing Firefox) are excluded from our Bug Bounty program

Comment 19

[Syahri Ramadan]

Hi, Thanks for updating

Comment 20

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/3f8e81810ce2
Set proto outparam in RemoteObjectProxyBase::getPrototypeIfOrdinary. r=peterv

Comment 21

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/3f8e81810ce2

Comment 22

[Syahri Ramadan]

Hi, Are you sure it's fixed?

Comment 23

[Ryan VanderMeulen [:RyanVM]]

Unless you're building Firefox directly from source, the fix isn't available in a shipping build yet. The fix should be in Nightly builds due to start about an hour from now.

Comment 24

[Syahri Ramadan]

Once fixed, can I upload publicly?

Comment 25

[Andrew McCreight [:mccr8]]

(In reply to Syahri Ramadan from comment #24)

Once fixed, can I upload publicly?

This bug is already public, so feel free to discuss it however you want.

Comment 26

[Syahri Ramadan]

Ok, I'll upload it on YouTube later. Thank you