1861420 - (CVE-2023-49061) HTML injection in %READER-BYLINE% of ReaderMode of Firefox for iOS

Status: VERIFIED FIXED

(Firefox for iOS :: Reader View, defect)

Description

[Muneaki Nishimura]

Attachment: demonstration-on-bitbucket.mov

The following commit replaced %READER-CREDITS% to %READER-BYLINE% in the ReaderMode template of Firefox for iOS.
https://github.com/mozilla-mobile/firefox-ios/commit/3c6ea106b139ae581b6bb6da86f31a1fe53fcb49#diff-953c74716db0300bf5fd5751de34b1ab0674deb75cacdd8ecae8ae7ba700da98R18

Previously, %READER-CREDITS% was prone to HTML injection attack but it was fixed on Bug 1653822 by escaping HTML tags in author name as follows.
https://github.com/mozilla-mobile/firefox-ios/blob/main/Client/Frontend/UserContent/UserScripts/MainFrame/AtDocumentStart/ReaderMode.js#L81
But the fix is not applied to %READER-BYLINE%, so HTML injection in ReaderMode is possible again through <meta [author]> tag in the original page.

The following URL is a demonstration of this bug on Atlassian BitBucket.
By abusing privilege escalation bug reported by Bug 1861405, XSS on internal://local through the bug can be achieved.
https://bitbucket.org/muneaki_nishimura/author/issues/1/test

Comment 1

[lmarceau]

Jira ticket for progress tracking only (no more info available in it) can be found here

Comment 2

[lmarceau]

Attachment: GitHub Pull Request

Comment 3

[Andrei Bodea[:andrei]]

Hello, can someone help me with some steps in order to verify this issue?

Comment 4

[Muneaki Nishimura]

I made a simple reproduction code for confirmation below.
https://csrf.jp/2023/poc1861420.php

This page contains <a> and <s> tags in a <meta [author]> tag. If this vulnerability reproduced, when the page is opened in ReaderMode, these tags are injected and a string link with a strike-through line appears in this page.

Comment 5

[Andrei Bodea[:andrei]]

Thank you very much Muneaki Nishimura!
I did check with the link you provided on an older version for Firefox like v118 and yes when I did enter the reader mode it was with a hyperlink for all the text there.
Verified as fixed on v120 (35899) with iPhone 13 Pro (15.7.1) when I enter the reader mode with https://csrf.jp/2023/poc1861420.php URL, everything is only displayed as a text, no hyperlinks.

Comment 6

[lmarceau]

Attachment: advisory.txt

Comment 7

[lmarceau]

Attachment: advisory.txt