1837833 - Spoofing Download Dialog in Firefox for Android

Status: RESOLVED DUPLICATE of bug 1791300

(Firefox for Android :: Downloads, defect, P2)

Description

[Shaheen Fazim]

Attachment: poc.html

In Firefox for Android, an attacker could spoof the download dialog using the below proof-of-concept. Here, the victim visits an attacker-controlled site and is asked to update the browser. When clicked, the victim is redirected to the official Mozilla site with the download dialog opened there. The attacker could also use the 'onload' event to directly execute this without a click. This method is most effective when sent via email, with hidden href, and the victim is directly redirected to the spoofed page.

Steps to Reproduce:

1. Download the file poc.html to a folder
2. Start a Python server on the same folder by running the command python -m http.server 8080.
3. Open the Android Firefox browser and navigate to the server at http://{YOUR-SERVER-IP}:8080/poc.html to Begin testing.

Video Demonstration: https://youtu.be/8yQtULpWkJQ (YouTube Unlisted)

Comment 1

[Shaheen Fazim]

Attachment: onload.mp4

Comment 2

[Shaheen Fazim]

The same spoofing method works with Chrome for Android, and it is also vulnerable.

(From Google Chrome Team)

I agree this is a bit misleading. Maybe the prompt shouldn't be displayed when the current tab displayed is different from the one who initiated the download? Or, maybe we should display the origin of the initiator?

Comment 3

[Chris Peterson [:cpeterson]]

Shaheen, thanks for the POC. I'll make sure this bug gets triaged.

Comment 4

[Shaheen Fazim]

Thank you. It appears that the Intent Dialogue is also vulnerable to a similar attack. I have opened a separate issue to address this vulnerability.