Open URL Redirection
Categories
(Firefox :: Untriaged, defect)
Tracking
()
People
(Reporter: mbopensource+bugzilla, Unassigned)
Details
Steps to reproduce:
Description
I've found an Open URL Redirection vulnerability connected with Mozilla Firefox browser.
Steps To Reproduce:
Type: https://www.mozilla.org/
Remove '/'. Add '@' and target site
Go to: https://mozilla.org@%47%4F%4F%47%4C%45%2E%43%4F%4D
It's obfuscated by me - provides to google.com (as an example). You can change the parts after " @" for your target site.
Examples (PoC): https://www.firefox.com@wikipedia.org
https://mozilla.org@google.com
All of scenarios (target point) can be obfuscated of course.
Actual results:
It's taking to https://examplecorp.com@attacker.example/ bad/incorrect site from point of view of Firefox user.
I agree that Mozilla Firefox in my opinion (doing quick research/comparison) has the best approach for this issue, as shows window with warning. It's really impressed approach for me. But it can be better / the best overall. What about warning and sites like microsoft vs/and nricrosoft, or facebook and facbook (so on, so on)?
Expected results:
"Browsers should not render a URL’s username and password, as they can be mistaken for a URL’s host (e.g., https://examplecorp.com@attacker.example/).", Source: URL Standard https://url.spec.whatwg.org/
Additional information: That's really dangerous and critical in my opinion. The link looks like authorized by Mozilla.org or Mozilla products in this case.
There could be a many ways of exploit this. It should be fixed ASAP to avoid the described scenario.
Let's stay in touch.
Best regards,
Michal
|
||
Comment 1•3 years ago
|
||
The Bugbug bot thinks this bug should belong to the 'Toolkit::Password Manager' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.
|
||
Comment 2•3 years ago
|
||
I agree that Mozilla Firefox in my opinion (doing quick research/comparison) has the best approach for this issue, as shows window with warning.
Exactly. So it's unclear what this ticket is exactly asking for, after performing these steps. Plus so it is not a "vulnerability".
The link looks like authorized by Mozilla.org or Mozilla products in this case.
No, https://mozilla.org@%47%4F%4F%47%4C%45%2E%43%4F%4D really does NOT look like https://mozilla.org .
|
Reporter | |
Comment 3•3 years ago
|
||
Hi Andre,
Thanks for answer.
I am affraid that your approach is not Security focused.
I can ask my grandpa, my parents, other non-technical people and stats will shows that 99% says 'it's OK, I will click'.
You can ask your friends (tech-common I hope) and they will say 99% that's not the same.
How many people we can recognize as tech/high tech and non-tech overall? I bet that minimum 70-30 if no higher difference (we can check that official stats, perhaps it's something like 90-10).
I'm pretty sure that examples like this are common used / exploited.
Next time please check it out the attached sources, like official URL Standard says "Browsers should not render a URL’s username and password, as they can be mistaken for a URL’s host", so on so on.
If you say that's no dangerous approach, it's fine for me. You say that. Have a good day.
Best,
|
|
Reporter | |
Comment 4•3 years ago
|
||
Just a note (to be noted here) - it works / please you can try with https://www.google.com@wikipedia.org@google.com@cnn.com
and similar structures (works). Best regards,
|
|
||
Comment 5•3 years ago
|
||
I can ask my grandpa, my parents, other non-technical people and stats will shows that 99% says 'it's OK, I will click'.
If you go to https://mozilla.org@%47%4F%4F%47%4C%45%2E%43%4F%4D , Firefox displays: "You are about to log in to the site google.com with the username mozilla%2Eorg".
The dialog explicitly says "google.com".
If "my grandpa, my parents" (which might be ageism to avoid) do not read dialogs, then adding more text or more dialogs certainly won't help.
"Browsers should not render a URL’s username and password, as they can be mistaken for a URL’s host (e.g., https://examplecorp.com@attacker.example/).", Source: URL Standard https://url.spec.whatwg.org/
That seems to refer to the URL / address / location bar. After which specific steps, as a list, does Firefox render that info in the address bar?
Description
•