1790542 - (CVE-2023-29540) allow-top-navigation-to-custom-protocols iframe sandbox bypass using sourceMappingUrls

Status: VERIFIED FIXED

(DevTools :: Console, defect, P3)

Description

[haxatron1]

Attachment: source-map.html

Using a redirect embedded into sourceMappingUrls it is possible to navigate to external protocol links in sandboxed iframes without allow-top-navigation-to-custom-protocols, (without a user gesture even!).

1. Host source-map.html and redirect.php on site 1 (attacker site), iframe.html on site 2 (victim site), as always change the URL present in the source-map.html and iframe.html files.
2. Open iframe.html in victim site, external protocol dialog will launch even with allow-top-navigation-to-custom-protocols absent.

Very useful for malvertisers as it also bypasses the user gesture requirement for external protocols.

Comment 1

[haxatron1]

Attachment: redirect.php

Comment 2

[haxatron1]

Attachment: iframe.html

Comment 3

[haxatron1]

Like the previous report, I realised that for Step 2, you must open devtools console, to load the sourcemap and trigger the external protocol prompt.

Comment 4

[Julian Descottes [:jdescottes]]

Our sourcemap implementation only checks the protocol of the sourcemap url before attempting to fetch it. So when the php redirects to another protocol, we ahve no way to check this new URL. We could completely forbid redirects when using fetch. Moving the sourcemap handling to the devtools server would also help.

Comment 5

[Julian Descottes [:jdescottes]]

Hi Daniel,

Could you help assess the priority and severity of this bug?

Comment 6

[Hubert Boma Manilla (:bomsy)]

Hi Haxatron1,

Thanks for the files and the STR.
I tried following the steps but was not able to reproduce. it does not trigger the external protocol prompt.

Can you clarify that the victims platform should be windows?

The suggestion from Julian makes sense, we could block redirects to as a quick easy fix for this.

Comment 7

[haxatron1]

Attachment: source.html

Comment 8

[haxatron1]

Attachment: iframe.html

Comment 9

[haxatron1]

Attachment: iframe.html

Comment 10

[haxatron1]

Hi, i've just uploaded a new set of PoCs that can be reproduced on bmoattachments. STR:

1. Open the iframe.html
2. Then press F12 to open Devtools, the external protocol prompt should popup asking to open ms-calculator:

Comment 11

[haxatron1]

And yes this reproduce on Windows (for ms-calculator: prompt). Haven't tried out other platforms yet.

Comment 12

[Hubert Boma Manilla (:bomsy)]

Thanks for updating files. I can easily reproduce the issue.

Comment 13

[Hubert Boma Manilla (:bomsy)]

Attachment: Bug 1790542 - [devtools] Do not allow redirects on the 'sourceMappingUrl' r=jdescottes

• Block redirects on sourceMappingUrl
• Add debugger test

Comment 14

[Hubert Boma Manilla (:bomsy)]

Attachment: Bug 1790542 - [devtools] Convert browser_source_map-reload.js test from using .sjs files to createTestHTTPServer r=ochameau

.sjs files depend on redirects to load static files.
In D168648 we block redirects on sourceMappingUrl, so this browser_source_map-reload.js
fails because we use .sjs to serve the content.

This patch refactors to no longer use .sjs files

Depends on D168648

Comment 15

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/7042ad8b36f3
https://hg.mozilla.org/mozilla-central/rev/1320da462737

Comment 16

[Daniel Bodea [:danibodea]]

Using steps in comment 10, I have reproduced this issue In Release v109.0.1 and v111.0.1 and verified the fix in Beta v112.0 (RC) and Nightly v113.0a1.
This issue could only be reproduced in Windows 10. It wouldn't reproduce in Win 7 or any others.

Comment 17

[June Wilde (she/her) [:jewilde]]

Attachment: advisory.txt