1802385 - (CVE-2023-28160) After redirect to moz-extension:-URL in the parent process, the URL changes to the underlying jar/file-URL

Status: RESOLVED FIXED

(WebExtensions :: Request Handling, defect, P2)

Description

[Rob Wu [:robwu]]

STR:

1. Open the global browser console.

2. Run the following snippet:
   await fetch("https://polished-glitter-21ad.hvfcetgxgijelkmhxy.workers.dev/redirect?url=" + WebExtensionPolicy.getByID('[e-mail]').getURL('shims/live-test-shim.js') )

   • Note: this snippet relies on the built-in webcompat add-on that has a web-accessible file (shims/live-test-shim.js). If the add-on ever disappears, create an extension with a file in web_accessible_resources, get the moz-extension:-URL to that file and call fetch on it.

3. Look at the reported URL.

Expected:

• It should be the moz-extension://uuid/shims/live-test-shim.js URL

Actual:

• It is the path to the underlying file or jar:-URL.
• Example from local Firefox build: file:///path/to/mozilla-central/browser/extensions/webcompat/shims/live-test-shim.js
• Example for a xpi file: jar:file:///path/to/addon-file.xpi!/shims/live-test-shim.js

This is especially a problem on Android, where extensions run in-process (i.e. extensions.webextensions.remote = false, until bug 1535365 is fixed). This means that a fetch from an extension page can leak the path of the underlying filesystem.

Comment 1

[Nika Layzell [:nika] (ni? for response)]

I investigated this issue in bug 1685403 comment 31. Based on my current understanding, I think it has a similar source to the issue in that bug, but a fix for that bug wouldn't necessarily fix this bug.

Comment 2

[Nika Layzell [:nika] (ni? for response)]

Marking as a sec bug out of an abundance of caution, as bug 1685403 is a security bug as well.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:zombie, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 4

[Rob Wu [:robwu]]

The underlying bug is being fixed in bug 1685403; I'm going to take this bug to attach a unit test for the specific scenarios.

I'm setting this as S2 because the other bug has the same severity. Marking as P2 because in practice the issue can only be triggered in this context on Android, where then number of supported extensions is limited.

Comment 5

[Rob Wu [:robwu]]

Attachment: Bug 1802385 - Use NS_GetFinalChannelURI in FetchDriver

Depends on D164656

Comment 6

[Rob Wu [:robwu]]

I'm moving the relevant part for this bug from bug 1685403 to this patch as agreed upon in https://phabricator.services.mozilla.com/D164656#5476661 .

Comment 7

[Rob Wu [:robwu]]

This bug was marked as a security bug out of caution (comment 2), because it links to another bug that's also marked a security bug. As explained at https://bugzilla.mozilla.org/show_bug.cgi?id=1685403#c42, the "security bug" part of that bug has already been fixed a long time ago. Moreover, there are no comments in this bug or patch that disclose information from bug 1685403. Therefore this bug does not automatically need to be flagged as a security bug.

The worst that this bug can do is that the path to Firefox's profile directory can be leaked on Android, e.g. as seen in the (failing) unit tests at https://bugzilla.mozilla.org/show_bug.cgi?id=1745761#c7 .

On Android, it looks like this: jar:file:///data/app/~~randomchars1==/org.mozilla.firefox_beta-randomchars2==/base.apk!/assets/extensions/webcompat/shims/live-test-shim.js

A potential practical application of this is fingerprinting, but there are other ways to do so (e.g. bug 1792377).

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Use NS_GetFinalChannelURI in FetchDriver r=rpl,valentin
https://hg.mozilla.org/integration/autoland/rev/554a5aa89673b88eda16bfe128656c5702afe5b9
https://hg.mozilla.org/mozilla-central/rev/554a5aa89673

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:robwu, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox110 to wontfix.

For more information, please visit auto_nag documentation.

Comment 10

[Frederik Braun [:freddy]]

Attachment: advisory.txt