Closed Bug 1795815 (CVE-2022-45418) Opened 2 years ago Closed 2 years ago

Css Draw Mouse Cursor to hide omni box

Categories

(Core :: DOM: CSS Object Model, defect)

Product:
Core
Component:
DOM: CSS Object Model
Type:
defect

Tracking

()

Status:
VERIFIED FIXED
Milestone:
108 Branch
Tracking Flags:
Tracking Status
firefox-esr102 107+ fixed
firefox106 --- wontfix
firefox107 + verified
firefox108 + verified

People

(Reporter: sas.kunz, Assigned: emilio)

References

Details

(Keywords: csectype-spoof, sec-moderate, Whiteboard: [reporter-external] [client-bounty-form] [verif?][adv-main107+][adv-esr102.5+])

Attachments

(8 files)

abusive3.html
155 bytes, text/html
Details
bandicam 2022-10-18 09-35-47-924.mp4
3.14 MB, video/mp4
Details
cursor.html
1.20 KB, text/html
Details
index.html
157 bytes, text/html
Details
128x128.png
782 bytes, image/png
Details
32x32.png
606 bytes, image/png
Details
Bug 1795815 - Fix cursor intersection detection on OOP iframes. r=jfkthame,smaug
48 bytes, text/x-phabricator-request
dmeehan
: approval-mozilla-beta+
dmeehan
: approval-mozilla-esr102+
Details | Review
advisory.txt
257 bytes, text/plain
Details
Attached file abusive3.html —

when the mouse drawing cursor at 128x128 is not inside the iframe, the cursor cannot exit the web content area. but when inside an iframe , it should be able to bust out of the web content area and can hide omnibox. maybe it could be more useful to an attacker if the cursor image was a spoofed URL

  1. open abusive.html
  2. move cursor to hide omnibox

i attached the POC video and html file

Flags: sec-bounty?

The test case doesn't do anything for me on OSX. It also appears to refer to a file hosted elsewhere. Does it reproduce for you? Can you please attach the full contents of the test case? Thanks.

This looks like it might be related to CSS, so I'll move it there.

Group: firefox-core-security → dom-core-security
Component: Security → DOM: CSS Object Model
Flags: needinfo?(sas.kunz)
Product: Firefox → Core
Attached file cursor.html —
Flags: needinfo?(sas.kunz)
Attached file index.html —
Attached image 128x128.png —
Attached image 32x32.png —

i reproduce on windows 10 , firefox 106.0 (64-bit).
download cursor.html, index.html, 128x128.png, 32x32.png. save all in same folder and then open index.html

(In reply to Andrew McCreight [:mccr8] from comment #2)

The test case doesn't do anything for me on OSX. It also appears to refer to a file hosted elsewhere. Does it reproduce for you? Can you please attach the full contents of the test case? Thanks.

This looks like it might be related to CSS, so I'll move it there.

yes, its refer to : https://cr.kungfoo.net/style/cursor/abusive-cursor.html, the poc url is in iframe.

here is the code:

<html>
<head></head>
<body>
<iframe src="https://cr.kungfoo.net/style/cursor/abusive-cursor.html" style="width:1200px;height:1000px;position:absolute;top:-100px;left:-100px;">
</iframe>.
</body>
</html>

This bug keeps coming back, as people have different configs :-(

I can reproduce using the original attached testcase on a Mac (Big Sur 11.7). Andrew couldn't on Monterey (12.6), although he wasn't seeing any custom cursors at all. Last time it was more about OS zoom settings.

Keywords: csectype-spoof, sec-moderate

This should reproduce everywhere. It's because this looks at the in-process root viewport... Basically, it's this line of code or so what needs to change to check the top-level viewport.

Assignee: nobody → emilio
Status: UNCONFIRMED → ASSIGNED
Ever confirmed: true

Fix cursor intersection detection on OOP iframes. r=smaug
https://hg.mozilla.org/integration/autoland/rev/493fa5767494e968e3bdbc90748e48765565089f
https://hg.mozilla.org/mozilla-central/rev/493fa5767494

Group: dom-core-security → core-security-release
Status: ASSIGNED → RESOLVED
Closed: 2 years ago
status-firefox108: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 108 Branch

The patch landed in nightly and beta is affected.
:emilio, is this bug important enough to require an uplift?

  • If yes, please nominate the patch for beta approval.
  • If no, please set status-firefox107 to wontfix.

For more information, please visit auto_nag documentation.

Flags: needinfo?(emilio)

Comment on attachment 9299369 [details]
Bug 1795815 - Fix cursor intersection detection on OOP iframes. r=jfkthame,smaug

Beta/Release Uplift Approval Request

  • User impact if declined: cursor might overlay address bar etc, if it's specified by an OOP iframe.
  • Is this code covered by automated tests?: No
  • Has the fix been verified in Nightly?: Yes
  • Needs manual test from QE?: Yes
  • If yes, steps to reproduce: Create a local file with the contents of comment 8, open it and hover near the top left corner.
  • List of other uplifts needed: none
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): Relatively straight-forward fix that uses the IntersectionObserver machinery.
  • String changes made/needed: none
  • Is Android affected?: No
Flags: needinfo?(emilio)
Attachment #9299369 - Flags: approval-mozilla-beta?
Flags: qe-verify+

Comment on attachment 9299369 [details]
Bug 1795815 - Fix cursor intersection detection on OOP iframes. r=jfkthame,smaug

Approved for 107.0b4.

Attachment #9299369 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
QA Whiteboard: [qa-triaged]

I have reproduced this issue on macOS 11, using the local files from comment 8, on an affected Nightly build (20221017213658).

The issue is verified as fixed on Beta 107.0b4 and latest Nightly 108.0a1, across OS's: Win 10 x64, macOS 11 and Ubuntu 18.04 x64.

Status: RESOLVED → VERIFIED
status-firefox107: fixed → verified
status-firefox108: fixed → verified
Flags: qe-verify+
QA Whiteboard: [qa-triaged]

Comment on attachment 9299369 [details]
Bug 1795815 - Fix cursor intersection detection on OOP iframes. r=jfkthame,smaug

See comment 14.

Attachment #9299369 - Flags: approval-mozilla-esr102?
Flags: sec-bounty? → sec-bounty+

Comment on attachment 9299369 [details]
Bug 1795815 - Fix cursor intersection detection on OOP iframes. r=jfkthame,smaug

Approved for 102.5esr.

Attachment #9299369 - Flags: approval-mozilla-esr102? → approval-mozilla-esr102+
Whiteboard: [reporter-external] [client-bounty-form] [verif?] → [reporter-external] [client-bounty-form] [verif?][adv-main107+]
Whiteboard: [reporter-external] [client-bounty-form] [verif?][adv-main107+] → [reporter-external] [client-bounty-form] [verif?][adv-main107+][adv-esr102.5+]
Alias: CVE-2022-45418
See Also: → 1804816
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: