1865465 - PopupNotifications Clickjacking: Bypass full screen prompt restrictions (Bug 1522120) and extended security delay (Bug 1857430)

Status: RESOLVED DUPLICATE of bug 1865914

(Toolkit :: PopupNotifications and Notification Bars, defect)

Description

[Hafiizh]

Attachment: bandicam 2023-11-18 17-07-17-233.mp4

i found a vulnerability where user can fall for clickjacking to allow camera permission or other permissions

I tested on Firefox version : developer edition 120.0b9(64-bit)

steps to reproduce:

1. Open clickjackingfirefox.html
   2 . Click on "To Play The Game Please Read Instruction" button then close/back to clickjackingfirefox.html page
2. Click on "Click 2-3 times ................................." button 2-3 times

references :
https://bugzilla.mozilla.org/show_bug.cgi?id=1826116
https://bugzilla.mozilla.org/show_bug.cgi?id=1857430

Comment 1

[Hafiizh]

Attachment: clickjackingfirefox.html

Comment 2

[Hafiizh]

this vulnerabilty is not only clickjacking but also the permission prompt can obscured the fullscreen notification

Comment 3

[Hafiizh]

steps to reproduce:

1. Open clickjackingfirefox.html
   2 . Click on "To Play The Game Please Read Instruction" button then close/back to clickjackingfirefox.html page
2. Click on "Click 2-3 times ................................." button 2-3 times

Comment 4

[Hafiizh]

Attachment: obscuredfullscreen.html

Comment 5

[Hafiizh]

Attachment: bandicam 2023-11-18 17-30-13-614.mp4

Comment 6

[Hafiizh]

Attachment: bandicam 2023-11-19 04-49-23-849.mp4

Comment 7

[Andrew McCreight [:mccr8]]

The partial obscuring of the full screen notification doesn't seem like too much of an issue.

It seems like the clickjacking relies on the user leaving the permission prompt up for a long time which doesn't seem too realistic, and the user has to also keep clicking through the weird flashing from the full screen transition. That being said, it doesn't seem great that we move the prompt and it retains the activation time.

Comment 8

[Paul Zühlcke [:pbz]]

This bypasses leaving full screen when a permission prompt shows (Bug 1522120) and therefore also the extended security delay we would apply in this case (Bug 1857430).

Comment 9

[Paul Zühlcke [:pbz]]

Verified fixed by Bug 1865914. Tested on Nightly 122.0a1 (2023-12-03) (64-bit) on Windows 11.

Comment 10

[Hafiizh]

hi pbz this bug has an ID earlier than 1865465 how do you say this is a duplicate

Comment 11

[Hafiizh]

i reported with id 1865465 it earlier than 1865914

Comment 12

[Paul Zühlcke [:pbz]]

I'm only duping this on Bug 1865914 since that's where the fix landed. This is done purely for practical reasons and doesn't have anything to do with bug bounty considerations. I'll make sure Dan is aware of that.