1789439 - (CVE-2022-42929) Persistent Popup DoS with window.print

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Andrei Enache]

I have been testing the window.print functionality in Firefox. At some point, I found that running two print() calls simultaneously in the console (without closing the dialog after the first one) leads to a new browser window opening without any popup permissions. The tab inside the new window is mostly broken, for example it cannot be redirected, but it does get restored by session restore function when quitting firefox.

After a bit of testing different methods to reproduce the parallel nature of this bug within single-threaded JavaScript, I ended up the the following (warning: will keep spawning windows indefinitely, in my case leading to OOM):

window.addEventListener('beforeprint', (event) => {
  print()
});
print()

This denial of service is persistent in multiple ways; if the malicious website remains open after session restore, or if the windows open by the malicious website are kept in session restore. When testing this it was difficult to stop the browser because the new windows were stealing focus, exacerbating the issue. Therefore this can lead to persistent full denial of service of browser functionality in the worst case.

This has been tested on Nightly, Mozilla Firefox 106.0a1 20220906092849 20220906092849.

Comment 1

[Emilio Cobos Álvarez (:emilio)]

Attachment: Test-case from reporter.

Comment 2

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1789439 - Don't allow reentrant programmatic print calls. r=smaug,peterv

Comment 3

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1789439 - Throw rather than logging an error when tab-modal print is already open. r=jwatt,mstriemer

If we succeed but return null, we end up retargeting to a new window
here:

https://searchfox.org/mozilla-central/rev/3aaca0a12a2d1463da54933bdbdae2f06fead06f/dom/ipc/ContentParent.cpp#5462-5465

Which is bad.

Depends on D156682

Comment 4

[Emilio Cobos Álvarez (:emilio)]

Attachment: Bug 1789439 - Test. r=smaug,peterv,jwatt

Depends on D156683

Comment 5

[Emilio Cobos Álvarez (:emilio)]

Should I land the test right away?

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/85a99403dd29
https://hg.mozilla.org/mozilla-central/rev/a219e399d593
https://hg.mozilla.org/mozilla-central/rev/4cbbc3ea57a0

Comment 7

[Daniel Veditz [:dveditz]]

Since this could abuse people it'd be nice to wait until this hits release (106) before landing the test.

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Is this ready for an ESR approval request? It grafts cleanly.

Comment 9

[Emilio Cobos Álvarez (:emilio)]

Comment on attachment 9293485 [details]
Bug 1789439 - Throw rather than logging an error when tab-modal print is already open. r=jwatt,mstriemer

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: comment 0, trivial-ish / simple fix
• User impact if declined: comment 0
• Fix Landed on Version: 106
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Fix is rather trivial. Alternative would be not taking the patch on esr.

Comment 10

[Pascal Chevrel:pascalc]

Do we also want to uplift https://hg.mozilla.org/mozilla-central/rev/4cbbc3ea57a0 ?

Comment 11

[Emilio Cobos Álvarez (:emilio)]

Yes, that's a test-only patch.

Comment 12

[Pascal Chevrel:pascalc]

Comment on attachment 9293485 [details]
Bug 1789439 - Throw rather than logging an error when tab-modal print is already open. r=jwatt,mstriemer

Approved for ESR 102.4.0, thanks.

Comment 13

[Pascal Chevrel:pascalc]

https://hg.mozilla.org/releases/mozilla-esr102/rev/a00311e3e478
https://hg.mozilla.org/releases/mozilla-esr102/rev/885afd7b97c1
https://hg.mozilla.org/releases/mozilla-esr102/rev/a941a8b2101a

Comment 14

[Tom Ritter [:tjr]]

Attachment: advisory.txt

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7e4dc756b62c
Test. r=smaug,peterv

Comment 16

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/7e4dc756b62c