1780571 - (CVE-2022-42931) Username leaked to form history

Status: RESOLVED FIXED

(Toolkit :: Form Manager, defect, P2)

Description

[Sergey Galich [:serg]]

STR

1. verify formhistory.sqlite is empty
2. go imdb login page (or any other login page)
3. attempt to login and save login in password manager
4. formhistory.sqlite will have username stored in plain text

Comment 2

[ineuw]

I can confirm. This is the formhistory.sqlite entry just now.

677 Bugzilla_login xxxxx@xxxxxxxxx 1 1658438391070000 1658438391070000 YCjMUXDaRsOqG9JK

Comment 3

[Daniel Veditz [:dveditz]]

Is this not intentional? The username is part of the form, and is not hidden text? I don't know what the expectations are for this. Are form fields supposed to be stored in one and only one place, so if it's part of a password it's no longer part of the form?

You're the triage owner so I guess you get to say :-) If this is a security bug what severity would you give it? sec-low? sec-moderate? just a privacy problem?

Comment 4

[Sergey Galich [:serg]]

(In reply to Daniel Veditz [:dveditz] from comment #3)

Is this not intentional? The username is part of the form, and is not hidden text? I don't know what the expectations are for this. Are form fields supposed to be stored in one and only one place, so if it's part of a password it's no longer part of the form?

You're the triage owner so I guess you get to say :-) If this is a security bug what severity would you give it? sec-low? sec-moderate? just a privacy problem?

Forms managed by Password Manager encrypt username and password.
Form History should not be involved if form is managed by Password Manager.

At the moment I think this is sec-low. Something that I expect to be encrypted can be found in plain form in another file nearby.

But it may turn to sec-moderate if I can use that username knowledge to figure the encryption key to decrypt password. This is something I still need to review.

Comment 5

[Sergey Galich [:serg]]

I've spoke with crypto folks, they feel current encryption should hold.

Comment 6

[Issam Mani [:issammani]]

This bug is similar to 394612

Comment 7

[Issam Mani [:issammani]]

Attachment: Bug 1780571 - Reproduce bug and add test to catch it. r=sgalich!

Comment 8

[Issam Mani [:issammani]]

Attachment: Bug 1780571 - Check if input is managed by LoginManager before saving it to FormHistory database. r=sgalich!

Depends on D154389

Comment 9

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Reproduce bug and add test to catch it. r=sgalich
https://hg.mozilla.org/integration/autoland/rev/d7d188482489b74205598e37ae1eb7f1a7152430
https://hg.mozilla.org/mozilla-central/rev/d7d188482489

Check if input is managed by LoginManager before saving it to FormHistory database. r=sgalich
https://hg.mozilla.org/integration/autoland/rev/65bd3d4ffbc9e9cc000b6cd3151f7f1325a1d396
https://hg.mozilla.org/mozilla-central/rev/65bd3d4ffbc9

Comment 10

[Sergey Galich [:serg]]

Removing security flag due to similar bug 394612 being public already.

Comment 12

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Attachment: advisory.txt