1863831 - (CVE-2024-1563) Full UXSS via opening Firefox Focus externally after silent background navigation

Status: RESOLVED FIXED

(Focus :: Security: iOS, defect)

Description

[James Lee]

We are able to achieve Full UXSS by calling iOS Firefox Focus externally after silent background navigation.

PoC:

https://pwning.click/googleloc.php (Open in Firefox Focus and leave the browser, last thing user has seen is only
https://pwning.click/googleloc.php)

<script>setTimeout(function() {location="https://google.com"}, 3000);</script>

https://pwning.click/focuslink.php (Open with other browsers/apps like iOS Chrome)

<a href="firefox-focus://open-url?url=javascript:document.write(document.domain)">Open with Firefox Focus</a>

Comment 1

[James Lee]

This is all possible (Full UXSS) because iOS Firefox Focus allows silent background navigation while user left the browser.

Comment 2

[lmarceau]

This is similar to Firefox iOS bug https://bugzilla.mozilla.org/show_bug.cgi?id=1850158

Comment 3

[James Lee]

Is that running javascript URI with firefox URI? that doesn't become UXSS on Firefox but it does become Full UXSS on Focus, which is very serious issue.

Comment 4

[James Lee]

Please check this Apple default mail app case too: https://pwning.click/RPReplay_Final1705153539.mp4

Comment 5

[James Lee]

Attachment: 1860075_focuslink.php.png

Hi Nish, please confirm that your fix PR 3973 https://github.com/mozilla-mobile/focus-ios/pull/3973 for https://pwning.click/focuslink.php on https://bugzilla.mozilla.org/show_bug.cgi?id=1860075#c10 is identical to this 1863831 report: https://pwning.click/focuslink.php

Comment 6

[James Lee]

Attachment: 1863831_focuslink.php.png

Comment 7

[lmarceau]

Here's a summary from the above comment and links. Could you confirm this is accurate :james?

Steps to reproduce

1. Navigate to https://pwning.click/googleloc.php
2. Leave Focus application (by moving it to background)
3. Open Safari
4. Navigate to https://pwning.click/focuslink.php in Safari
5. Click on the link "Open with Firefox Focus"

Actual behavior

Focus is opened and JavaScript is running

Expected behavior

Focus is opened and JavaScript should not be running

Comment 8

[James Lee]

Yeah that's correct, this had same steps to the one Nish told Andrei https://bugzilla.mozilla.org/show_bug.cgi?id=1860075#c14

Thanks for confirming!

Comment 9

[James Lee]

We can now close this report so the new one Andrew added for See Also which is https://bugzilla.mozilla.org/show_bug.cgi?id=1876851 can also be tracked correctly in the future. Thanks!

Comment 10

[lmarceau]

Ok I'll marked it as duplicate of 1876851 so we keep only one bug open for those STR listed here.

Comment 11

[James Lee]

Thanks, but I believe this should be marked as resolved not duplicate due to https://github.com/mozilla-mobile/focus-ios/commit/0ecc6ed809a65c408c2216b9fe45abf9185f96eb for v122.

Comment 12

[lmarceau]

Ok I can make that change

Comment 13

[lmarceau]

Attachment: googleloc.php.html

Comment 14

[lmarceau]

Attachment: focuslink.php.html

Comment 15

[Tom Ritter [:tjr]]

Hey, sorry for the hassle, but could you update the tracking flags to indicate which version it was fixed it? It helps us with bookkeeping. Thank you!

Comment 16

[lmarceau]

Attachment: advisory.txt

Comment 17

[Daniel Veditz [:dveditz]]

Putting the needinfo back: looks like it was inadvertently removed when the advisory attachment was added. I suppose the advisory implies this was fixed in v123? It would still be nice to update the status flags to say that explicitly

Comment 18

[lmarceau]

Yes it was for v123! Hopefully I marked the right fields in the ticket here

Comment 19

[James Lee]

This is supposed to be fixed on v122 https://github.com/mozilla-mobile/focus-ios/pull/3973

Comment 20

[lmarceau]

Ah sorry James you're right! Let me adjust this.

Comment 21

[James Lee]

No worries, thanks!

Comment 22

[Daniel Veditz [:dveditz]]

status-firefox123: fixed is true, even if it's not the first version that was fixed. unfortunately we can't set the older fields as they get made read-only in bugzilla to reduce clutter.

Comment 23

[Daniel Veditz [:dveditz]]

This one is less universal than the previous one (involves user interaction with the other app) but still a valid UXSS

Comment 25

[Daniel Veditz [:dveditz]]

There is no separate fix here -- this should have been marked a duplicate of bug 1860075

Comment 26

[James Lee]

This was fixed in https://github.com/mozilla-mobile/focus-ios/pull/3973 and it's not a duplicate of bug 1860075 which is the fix of 302 redirect UXSS.

Comment 27

[James Lee]

This is firefox-focus:// deeplink UXSS which is a slightly limited impact compared to bug 1860075, while bug 1860075 is Server Side Redirect to javascript: URI UXSS with no deeplink, they're completely different bug.

Assignee lmarceau (https://bugzilla.mozilla.org/user_profile?user_id=694570) forgot to move https://github.com/mozilla-mobile/focus-ios/pull/3973 from the wrong report bug 1860075 to the correct report which is this report bug 1863831 .

Fixed in Focus 122: bug 1863831 == https://github.com/mozilla-mobile/focus-ios/pull/3973

Fixed in Focus 123: bug 1860075 == https://github.com/mozilla-mobile/focus-ios/pull/3989

Comment 28

[James Lee]

Therefore a bounty flag for bug 1863832 should've not been cancelled.

The claim of engineer would've known and fixed bug 1863832 anyways, therefore it's ineligible for bounty award is not a valid reason since that only applies to main report https://bugzilla.mozilla.org/show_bug.cgi?id=1863832#c0 which has no fix.

3 Spoofing Vulnerabilities report starts from https://bugzilla.mozilla.org/show_bug.cgi?id=1863832#c8 after engineer Razvan asked me wha
t's an issue since UXSS part doesn't work anymore after the fix in this report.

The report would've been closed without me further commenting freshly discovered spoofing bug in https://bugzilla.mozilla.org/show_bug.cgi?id=1863832#c8 and onwards.