1859762 - "Logins & Passwords" tab. "Search Login" input allows you to search using a remembered password and bypasses primary password protection.

Status: RESOLVED DUPLICATE of bug 1634906

(Toolkit :: Password Manager, defect)

Description

[MeHow25]

Attachment: 2023-10-18 12-38-07.mp4

"Logins & Passwords" tab. "Search Login" input allows you to search using a remembered password and bypasses master password protection. This, of course, allows for a very easy and quick brute-force attack.

Theoretically, to get to the "Logins and passwords" tab, I need to know the master password. I will now present a simple scenario where this could be dangerous anyway.

1. I turn on Mozilla Firefox. I am asked immediately for the master password. I enter this password.
2. After a while, I have to go somewhere, but I leave my computer and browser on.
3. The intruder takes this opportunity to see my website passwords. So he goes to the "Logins & Passwords" tab. He is not asked for the master password because I entered it at the beginning of opening Firefox. At this point he can click on any website and click the "Show password" (eye icon) or just copy it button. Firefox doesn't allow him to do this because a window pops up asking him to enter the master password.
4. The intruder knows how to bypass this protection. All he needs to do is enter a potential password or just a letter or letters in the "Search Logins" field. This is because this input looks not only for the login but also for the password. (Is it supposed to work like this?). In addition, he is not asked for the master password. This bug allows an unauthorized person to gain access to a user's stored passwords by guessing them. Of course, a smarter intruder will write some brute-force script. It will be very fast because we are not limited in any way in our search. There is no limit on requests and everything is displayed immediately.

In my opinion, you should be able to search there only for the login, without the password. Or just be asked for your master password to do it.

To demonstrate this better, I will try to record a video and attach it.

System: Windows 10
Firefox: Version 118.0.2 (64-bit)