1811999 - (CVE-2023-34415) Server-side redirects to data: URL inherits process of redirector in Fission

Status: RESOLVED FIXED

(Core :: DOM: Content Processes, defect, P3)

Description

[Jun (Request needinfo for comment, I ignore other updates)]

Attachment: frame_data.html

Open redirect in a website are considered as not a vulnerability in many sites (e.g. https://bughunters.google.com/learn/invalid-reports/web-platform/navigation/6680364896223232/open-redirectors).

This is especially true for server-side redirect because a server-side redirect to Javascript URLs are blocked in all browsers (therefore, not threat for XSS).

However, Firefox inherits process from a redirect initiator when a server-side redirect happens to data: URLs. Therefore, sites which intentionally allows server-side open redirect are vulnerable to Spectre or other inprocess attacks.

Please note that server-side redirect to data: URLs are only supported in Firefox (among major browsers), so this threat only applies to Firefox.

Steps:

1. Open attached file.
2. Open about:processes
3. Observe that the data: URL iframe lives in the same process as vuln.shhnjk.com

Comment 1

[Frederik Braun [:freddy]]

If no other browser supports subdocument loads of data:, I suppose the solution is to expand our restriction for top level loads of data: URLs to other types?

I wonder what the spec situation is here.

Comment 2

[Jun (Request needinfo for comment, I ignore other updates)]

Just to clarify, iframes with data: URLs are supported in major browsers. What's not supported is the server-side redirect to data: URLs (which is only supported in Firefox).

Comment 3

[Daniel Veditz [:dveditz]]

I wonder what the spec situation is here.

Apparently "don't do it": bug 1691658

In old versions of Firefox before we started using an opaque origin for data: documents then the resulting data document would be in the redirector's origin. This would allow anyone to XSS that domain so people with redirects had to be careful to restrict them to the https? urls (javascript was a problem, too). As more and more browsers have blocked each of those, and Firefox no longer inherits the origin into a data documents, future sites with redirects may forget to be so careful and this will be a bigger problem.

Is this bug useful to keep open separately, or should it be duped to bug 1691658?

historical note: we "fixed" broken redirects to data: for some site in bug 211999 and worried about breaking it for e10s in bug 707624

Comment 4

[:Gijs (he/him)]

Should be fixed by bug 1691658 on current Nightly.

Comment 5

[Daniel Veditz [:dveditz]]

Although we already knew that servers could redirect to data: and that it violated the spec (e.g. bug 1691658 and earlier). The fact that we're getting the process wrong on top and therefore introducing Spectre risks, is new info and that's what the bounty is awarded for.

Comment 6

[Jun (Request needinfo for comment, I ignore other updates)]

Great, thanks!

Comment 7

[Daniel Veditz [:dveditz]]

Attachment: advisory.txt