1785226 - Navigate to tel: links and other non-web content from Firefox Android QR code scanner using redirects

Status: RESOLVED WONTFIX

(Firefox :: Security, defect)

Description

[haxatron1]

Attachment: mal_qrcode.png

I was reading past Firefox advisories and came across https://www.mozilla.org/en-US/security/advisories/mfsa2022-01/#CVE-2022-22749. Unfortunately, this vulnerability isn't public so I'll have to speculate what this is about. My guess is that this vulnerability is about the ability to navigate to tel: links and other external protocols in Firefox Android by scanning a malicious QR code pointing directly to the external protocol link which are all non-web content. However, I find a way to open a tel: link directly from the QR scanner using redirects

If you scanned a QR code pointing to a external protocol such as tel:1 on Android. You will fail. I speculate that this was what https://www.mozilla.org/en-US/security/advisories/mfsa2022-01/#CVE-2022-22749 was about.

But if you scanned a QR code pointing to a site which redirects to tel:1, such as http://httpbin.org/redirect-to?url=tel:1, you will be redirected to tel:1 and open the Telephone app on Android.

REPRODUCTION STEPS
Tested on Firefox version: 103.2.0 (Latest version)

1. Scan the attached QR code on Firefox Android

Comment 1

[Sergey Galich [:serg]]

:haxatron1 thanks for filing this bug!

QR code is nothing more than a URL encoded as an image, we can simplify this scenario to "Open http://httpbin.org/redirect-to?url=tel:1 link and it will redirect to the phone's call app". Which is the same as opening tel:1 link directly. And it offers me the chance to select which app I'm using to do calls. So far it looks like it works as expected.

What would be the attack/harm if someone is using tel: links (directly or through redirect)?

Comment 2

[haxatron1]

I initially thought that the https://www.mozilla.org/en-US/security/advisories/mfsa2022-01/#CVE-2022-22749 was about tel: links but it looks like its more about links which cannot be accessed fron redirects. It looks like I was mistaken in some of my assumptions. I Apologies for that. I'll proceed to close this issue

Comment 3

[Sergey Galich [:serg]]

(In reply to haxatron1 from comment #2)

I initially thought that the https://www.mozilla.org/en-US/security/advisories/mfsa2022-01/#CVE-2022-22749 was about tel: links but it looks like its more about links which cannot be accessed fron redirects. It looks like I was mistaken in some of my assumptions. I Apologies for that. I'll proceed to close this issue

No need to apologize! It's best to file a bug if there is any concern and we can figure it out together :)
Thank you for doing that.