1862257 - Firefox Webfilter Bypass Vulnerability via <embed> Tag

Status: NEW

(Firefox :: Enterprise Policies, defect, P3)

Description

[Shaheen Fazim]

The Enterprise Policy for the Firefox Webfilter, which blocks a host, can be bypassed using an <embed> tag. I have used the policy setting below to block the example.com site. All forms of navigation are blocked, including redirects and iframes, except for the <embed> tag. An attacker can exploit this to bypass the policy and navigate users to a enterprise blocked site using the <embed> tag.

{
  "policies": {
    "WebsiteFilter": {
      "Block": ["https://example.com"]
    }
  }
}

proof-of-concept:

<embed src="https://example.com"></embed>

Comment 1

[Shaheen Fazim]

Attachment: demo.mp4

Comment 2

[Daniel Veditz [:dveditz]]

This is obviously a bug from the POV of the enterprise setting these policies, but it's not a security risk to the Firefox user so we can unhide this.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:mkaply, could you have a look please?

For more information, please visit BugBot documentation.

Comment 4

[Shaheen Fazim]

Hi, friendly ping.

Comment 5

[Mike Kaply [:mkaply]]

Just so I remember, fix is to add

  contentType == Ci.nsIContentPolicy. TYPE_OBJECT

here:

https://searchfox.org/mozilla-central/source/browser/components/enterprisepolicies/helpers/WebsiteFilter.sys.mjs#120

The embed won't load at all.