1863838 - (CVE-2024-8399) iOS Firefox Focus javascript URI address bar spoofing

Status: RESOLVED FIXED

(Focus :: Security: iOS, defect)

Description

[James Lee]

We are able to spoof address bar of iOS Firefox Focus with javascript: URI as if we are on https.

This is worse than https://bugzilla.mozilla.org/show_bug.cgi?id=1325955 since javascript:// part is not viewable by users but only facebook.com just like when we are on https.

Comment 1

[James Lee]

Attachment: 1863838.html

Tap on Cat to reproduce this.

Comment 2

[James Lee]

Attachment: 1863838.mp4

Comment 3

[James Lee]

Attachment: 1874573.html

https://bugzilla.mozilla.org/show_bug.cgi?id=1874573 and non-existent protocol like abcd:// allows to achieve full address bar spoof, but before that let's check anchor click full address bar spoof first.

While this is already semi-full address bar spoof, we are able to completely hide javascript:// part even if we tab multiple times to check that. PoC is same with iOS Firefox for click based one, please test with the attached file.

Comment 4

[James Lee]

Attachment: 1863838_trick.html

Now, interesting trick here is that iOS Firefox Focus confuses when we load non-existent protocol like abcd:// and so it'll load the URL after that part leading to complete spoof, whether you allow the confirmation or not.

Comment 5

[James Lee]

Attachment: RPReplay_Final1705190313.mp4

This is anchor tag click version

Comment 6

[James Lee]

Attachment: RPReplay_Final1705191893.mp4

This is also complete spoof but without opening link with non-existent protocol abcd://google.com achieving Full Address bar Spoof.

Side note which should be confirmed:

This also further proves that "Open Link" UXSS https://bugzilla.mozilla.org/show_bug.cgi?id=1855117 and window.open() one's https://bugzilla.mozilla.org/show_bug.cgi?id=1855030 root cause is different, as I had to use non-existent protocol trick to make it work while "Open Link" didn't need any trick for this spoof.

Comment 7

[James Lee]

Attachment: 1863838_Final.html

It was the behaviour that only search part is showed on address bar allowing full spoof when we requested non-existent protocol abcd://abcd together.

Please test with this case.

Comment 8

[James Lee]

Attachment: RPReplay_Final1706048203.mp4

Comment 9

[James Lee]

Hi, I confirmed this issue is not fixed on latest 122 so could you test or bring someone to verify this? thanks!

Comment 10

[lmarceau]

Hello! I don't see any patches for this issue, so I don't think this was planned to be fixed, nor communicated that it was fixed. It's in our backlog. Thank you!

Comment 11

[Nishant Bhasin]

James, I have mentioned it in another ticket too but what exactly are the steps here. We will need that for our QA and also for devs to fix this.

The video is not enough and would like you to provide steps to make sure we are doing the right thing.

Thank you.

Comment 12

[James Lee]

Hi, I already mentioned the step in this report.

https://bugzilla.mozilla.org/show_bug.cgi?id=1863838#c1

Tap on Cat to reproduce this.

Comment 13

[James Lee]

Please tap on Cat to reproduce this on https://bugzilla.mozilla.org/attachment.cgi?id=9376188

Comment 14

[lmarceau]

Here's a summary from the above comment and links. Could you confirm this is accurate :james?

Steps to reproduce

1. Spin off a local server to be able to navigate to the provided 1863838_Final.html use case. This can be done following the steps listed here.
2. Navigate to the 1863838_Final.html use case.
3. Click on the cat image shown. FYI clicking on the cat image will navigate to the attached fbspoof.html (attached to this bug for posterity).
4. Observe the URL appearing in the URL bar.

Actual behavior

The shown URL is "facebook.com"

Expected behavior

The shown URL shouldn't be "facebook.com"

Note

The 1874573 use case commented above is in Firefox iOS whereas the current bug discussion is about Focus iOS. To avoid confusion between bugs, let's keep conversation about the current use case only as both project are not sharing code at the moment. Thank you.

Comment 15

[lmarceau]

Attachment: fbspoof.html

Comment 16

[James Lee]

Hi, a lot's of details are added on comments and the final test case is not 1863838.html but https://bug1863838.bmoattachments.org/attachment.cgi?id=9376188 as I mentioned on https://bugzilla.mozilla.org/show_bug.cgi?id=1863838#c13

other than that, it looks good.

Comment 17

[lmarceau]

Mh, https://bug1863838.bmoattachments.org/attachment.cgi?id=9376188 is in fact the linked 1863838_Final.html on this ticket no? So I think we I can adjust the above steps, and will deprecate the other attached file to avoid confusion.

Comment 18

[James Lee]

Yes, thanks!

Comment 19

[Liz Henry (:lizzard)]

mreagan or jeremy, can you help find a owner to look at this sec-high issue? Thanks!

Comment 20

[James Lee]

Attachment: 1863838_updated.html

Hi, I updated the PoC and demo video.

Comment 21

[James Lee]

Attachment: RPReplay_Final1723657263.mp4

Comment 22

[mreagan]

Checking to see who on iOS team might be able to pick this up.

Comment 23

[James Lee]

Attachment: RPReplay_Final1723901817.mp4

We're able to run both UXSS and Address bar Spoofing together: https://jsfiddle.net/onzyhea9/

Fix: Don't allow to open "javascript://" link

Comment 24

[Ryan VanderMeulen [:RyanVM]]

This was fixed and backported to the upcoming v130 release.
https://github.com/mozilla-mobile/firefox-ios/commit/3bf5b1687cb9be3685277fee6be7014b2c02a8c3
https://github.com/mozilla-mobile/firefox-ios/commit/7475f7f33e9a02f1e7d820dfcd87c8c753f912c0

Comment 25

[mreagan]

Attachment: advisory.txt