1792643 - (CVE-2022-45420) iframe contents can be arbitrarily drawn outside of iframe.

Status: VERIFIED FIXED

(Core :: Web Painting, defect)

Description

[prada960808]

Attachment: main.html

Steps to reproduce:

1. Download 'main.html' and 'iframe.html' in the same directory.
2. open 'main.html' on Firefox 105.

Actual results:
The content in the iframe is arbitrarily drawn outside of the iframe.

Expected results:
The content in the iframe should not be drawn outside of the iframe.

Severity:
This is vulnerable because the iframe domain (i.e., attacker) can fully cover the page of the main frame (i.e., victim) with any images using CSS margin-left, margin-top, and background-image (or background).

Environment:
Version: Firefox 105.0b5
OS: ubuntu 20.04

How was this issue discovered?
I used my fuzzer to find this issue.

Comment 1

[prada960808]

Attachment: iframe.html

Comment 2

[prada960808]

Attachment: screenshot.png

Comment 3

[Timothy Nikkel (:tnikkel)]

Attachment: Bug 1792643. Set clip on background items for table cols and colgroups, when the table row, rowgroup or table has captured clip. r?mstange

Exactly like bug 1735265 except a frame other then the cell, between the
cell and the table frame is a stacking context.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1409114

Comment 6

[Donal Meehan [:dmeehan]]

Set clip on background items for table cols and colgroups, when the table row, rowgroup or table has captured clip. r=mstange
https://hg.mozilla.org/integration/autoland/rev/e9d6b6dc577aa1532c7a42b1a8e404db75457237
https://hg.mozilla.org/mozilla-central/rev/e9d6b6dc577a

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:tnikkel, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox106 to wontfix.

For more information, please visit auto_nag documentation.

Comment 8

[Timothy Nikkel (:tnikkel)]

I don't feel like we need to uplift this. If anyone thinks we do I can do it though.

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Please nominate this for ESR102 approval. It grafts cleanly.

Comment 10

[Timothy Nikkel (:tnikkel)]

Comment on attachment 9296926 [details]
Bug 1792643. Set clip on background items for table cols and colgroups, when the table row, rowgroup or table has captured clip. r?mstange

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: sec-low, should be a pretty safe fix
• User impact if declined: sec-low, attacker can draw outside of iframe contents
• Fix Landed on Version: 107
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): pretty straight forward extension of a fix that's been on release for a while now with no regressions

Comment 11

[Donal Meehan [:dmeehan]]

Comment on attachment 9296926 [details]
Bug 1792643. Set clip on background items for table cols and colgroups, when the table row, rowgroup or table has captured clip. r?mstange

Approved for 102.5esr.

Comment 12

[Donal Meehan [:dmeehan]]

https://hg.mozilla.org/releases/mozilla-esr102/rev/df5f6cd3a002

Comment 13

[Hani Yacoub, Desktop QA]

Verified as fixed on Windows 10 x64, macOS 11.6 and on Ubuntu 20.04 x64.

Comment 14

[Hani Yacoub, Desktop QA]

Verified as fixed on Firefox 102.5esr on Windows 10 x64, macOS 11.6 and on Ubuntu 20.04 x64.

Comment 15

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Attachment: advisory.txt