1844827 - (CVE-2024-6611) SameSite cookies are set by cross-site iframe navigations

Status: RESOLVED FIXED

(Core :: Networking: Cookies, defect, P2)

Description

[Pedro Bernardo [:pedrob]]

Attachment: poc.js

Hello,

As part of a research project at TU Wien, we are assessing the security implications of WPT tests. We encountered an inconsistency in Firefox, which allows setting SameSite=Strict and Lax cookies from cross-site navigations. This inconsistency allows a gadget attacker (e.g., an ad embedded as an iframe in a benign website, good.com) to deauthenticate users. When paired with a same-site attacker scenario (e.g., when the attacker controls a subdomain of the target website such as atk.good.com), this inconsistency enables stealthy cookie-tossing attacks, which an attacker could leverage to perform more effective session fixation or CSRF token fixation attacks by removing the need for the victim to navigate to the attacker-controlled subdomain.

The deauth attack has the following flow:

1. User navigates to good.com
2. good.com sets a cookie auth=1; SameSite=Strict and embeds evil.com.
3. evil.com navigates itself to good.com/logout, e.g., via window.location.href="http://good.com/logout", which overwrites the auth cookie with auth=0; SameSite=Strict.

The auth cookie (SameSite=Strict or Lax) is set for good.com from a non-top-level cross-origin navigation originating from evil.com. In contrast with Firefox, Chrome does not set these cookies. Although not explicitly mentioned by rfc6265bis, we would argue that Chrome's behavior is more in line with the semantics and expectations of SameSite cookies.

The complete NodeJS code of the PoC is attached to this vulnerability report.

This behavior is captured by the (failing) WPT test: setcookie-navigation.https.html, in particular, the subtest "Cross-site to same-site iframe navigation should only be able to set SameSite=None cookies".

We searched Bugzilla for related issues but found only two bug reports (bug#1692207 and bug#1572607) referencing this test without a clear discussion of its security implications.

Thank you and best regards,
Pedro

Comment 1

[Daniel Veditz [:dveditz]]

We searched Bugzilla for related issues but found only two bug reports (bug#1692207 and bug#1572607) referencing this test without a clear discussion of its security implications.

and bug 1793083

Comment 2

[Daniel Veditz [:dveditz]]

Although not explicitly mentioned by rfc6265bis, we would argue that Chrome's behavior is more in line with the semantics and expectations of SameSite cookies.

I agree that the Firefox behavior is wrong here. I find the spec to be pretty explicit about that. With the caveat that §4.1.2 is labeled "non-normative", it does tell us what ought to happen. §4.1.2.7 says:

The "SameSite" attribute affects cookie creation as well as delivery. Cookies which assert "SameSite=Lax" or "SameSite=Strict" cannot be set in responses to cross-site subresource requests, or cross-site nested navigations. They can be set along with any top-level navigation, cross-site or otherwise.

In the definitely-normative §5.6 Storage Model algorithm, step 18 describes what to do when setting a cookie with a SameSite value of "Strict" or "Lax". If the request is same-site then you can always set the cookie (point 2). If you get to point 3 then you're dealing with a cross-site request, and those are only allowed if you are "navigating a top-level traversable". iframe navigations are not "top-level" so point 4 says "ignore the newly created cookie entirely".

Although Firefox is getting this wrong, this mechanism provides only limited protection. As §5.5.7.1 points out,

Attackers can still pop up new windows or trigger top-level navigations in order to create a "same-site" request (as described in Section 5.2.1), which is only a speedbump along the road to exploitation.

Comment 3

[edgul]

Attachment: Bug 1844827 - Added third party detection for subdocuments visiting top-level same site pages

Comment 4

[edgul]

Attachment: Bug 1844827 - Update the cookie test expectations for iframe samesite r?valentin

changes r?#cookie-reviewers

Depends on D199770

Comment 5

[edgul]

Attachment: Bug 1844827 - Added checks for sub-document navigations from cross-site to same-site in third-party checks when setting a cookie. r=valentin,dveditz,bvandersloot

Comment 6

[Daniel Veditz [:dveditz]]

Sorry for the burst of bugspam: filter on tinkling-glitter-filtrate
Adding reporter-external keyword to security bugs found by non-employees for accounting reasons

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/mozilla-central/rev/1eb6a4e2316b
Added checks for sub-document navigations from cross-site to same-site in third-party checks when setting a cookie. r=cookie-reviewers,valentin,bvandersloot
https://hg.mozilla.org/mozilla-central/rev/00d52f0a38b3
Update the cookie test expectations for iframe samesite r=cookie-reviewers,valentin

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/1eb6a4e2316b
https://hg.mozilla.org/mozilla-central/rev/00d52f0a38b3

Comment 9

[Donal Meehan [:dmeehan]]

:edgul could you please add a beta uplift request when ready?

Comment 10

[edgul]

Comment on attachment 9376732 [details] [diff] [review]
Bug 1844827 - Update the cookie test expectations for iframe samesite r?valentin

Beta/Release Uplift Approval Request

• User impact if declined: Malicious iframes will be able to force a website to set a samesite strict or lax cookie it may not have otherwise set.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Should only affect cross-origin (ABA-like) scenarios on navigation.
  We added a pref to easily toggle this off.
  WPTs seem fine. Manual testing seems fine.
• String changes made/needed:
• Is Android affected?: Yes

Comment 11

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9390230 [details]
Bug 1844827 - Added checks for sub-document navigations from cross-site to same-site in third-party checks when setting a cookie. r=valentin,dveditz,bvandersloot

Approved for 128.0b3.

Comment 12

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/5f32aac17dfe
https://hg.mozilla.org/releases/mozilla-beta/rev/37a0013e5e67

Comment 13

[Simon Friedberger [:simonf]]

Attachment: advis

Comment 14

[Simon Friedberger [:simonf]]

Attachment: advisory.txt

Comment 15

[Simon Friedberger [:simonf]]

Attachment: advisory.txt