1866661 - (CVE-2025-1935) Clickjacking of permission prompts for registerprotocol

Status: RESOLVED FIXED

(Toolkit :: PopupNotifications and Notification Bars, defect, P3)

Description

[Hafiizh]

Attachment: bandicam 2023-11-26 09-46-34-630.mp4

i found a vulnerability where user can fall for clickjacking to added register protocol permission

I tested on Firefox version 122.0a1 (2023-11-25) (64-bit)

steps to reproduce:

1. open https://pwed.my.id/clickjack/registerprotocol.html or Open registerprotocol.html
2. double click the "double click" button without moving the mouse then the register protocol will be added

Comment 1

[Hafiizh]

Attachment: registerprotocol.html

Comment 2

[Daniel Veditz [:dveditz]]

The damage from this one is relatively low: it means the attacker can open a web page when such a protocol is clicked. There are very few protocols that other web pages are going to use. mailto: is the most likely, and typically that will only leak an email address (though in uncommon cases a mailto: link can be much more complex). One experience of it and the user will realize something is wrong and fix it.

This prompt is an info-bar like the popup-blocker one. It's definitely different code from the "panel" style prompts.

Comment 3

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:serg, could you have a look please?

For more information, please visit BugBot documentation.

Comment 4

[Daniel Veditz [:dveditz]]

Emma: is this one you can find an owner for?

Comment 5

[Emma Zühlcke [:emz]]

Looks like we should add a security delay to the notification bar code: https://searchfox.org/mozilla-central/source/toolkit/content/widgets/notificationbox.js
Edit: apologies, I initially linked devtools code by mistake.

Comment 6

[Emma Zühlcke [:emz]]

Attachment: Bug 1866661, r=hjones,mak

Comment 7

[Emma Zühlcke [:emz]]

Attachment: Bug 1866661 - Tests, r=hjones,mak

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8c9c618c737e
r=hjones,reusable-components-reviewers,Gijs
https://hg.mozilla.org/integration/autoland/rev/01a7a1c27f90
Tests, r=hjones

Comment 9

[Donal Meehan [:dmeehan]]

https://hg.mozilla.org/mozilla-central/rev/8c9c618c737e
https://hg.mozilla.org/mozilla-central/rev/01a7a1c27f90

Comment 10

[BugBot [:suhaib / :marco]]

The patch landed in nightly and beta is affected.
:emz, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval. Also, don't forget to request an uplift for the patches in the regression caused by this fix.
• If no, please set status-firefox136 to wontfix.

For more information, please visit BugBot documentation.

Comment 11

[Emma Zühlcke [:emz]]

Attachment: Bug 1866661, r=hjones,mak

Original Revision: https://phabricator.services.mozilla.com/D235457

Comment 12

[Phabricator Automation]

beta Uplift Approval Request

• User impact if declined: Users are vulnerable to clickjacking attacks using the notification box UI in Firefox. This UI is used by websites to ask permission for installing custom protocols.
• Code covered by automated testing: yes
• Fix verified in Nightly: no
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: -
• Risk associated with taking this patch: low
• Explanation of risk level: There is a low risk that we break the notification box buttons which may block users. The bug had a regression which we since fixed. The fix and the clickjacking functionality as a whole has good test coverage now.
• String changes made/needed: -
• Is Android affected?: no

Comment 13

[Emma Zühlcke [:emz]]

Attachment: Bug 1866661, r=hjones,mak

Original Revision: https://phabricator.services.mozilla.com/D235457

Comment 14

[Phabricator Automation]

esr128 Uplift Approval Request

• User impact if declined: Users are vulnerable to clickjacking attacks using the notification box UI in Firefox. This UI is used by websites to ask permission for installing custom protocols.
• Code covered by automated testing: yes
• Fix verified in Nightly: no
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: -
• Risk associated with taking this patch: low
• Explanation of risk level: There is a low risk that we break the notification box buttons which may block users. The bug had a regression which we since fixed. The fix and the clickjacking functionality as a whole has good test coverage now.
• String changes made/needed: -
• Is Android affected?: no

Comment 15

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/bd7ea6477874

Comment 16

[Emma Zühlcke [:emz]]

Attachment: Bug 1866661, r=hjones,mak

Original Revision: https://phabricator.services.mozilla.com/D235457

Comment 17

[Emma Zühlcke [:emz]]

Attachment: Bug 1866661 - Tests, r=hjones,mak

Original Revision: https://phabricator.services.mozilla.com/D235760

Comment 18

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/e373ac3cb59c

Comment 19

[Donal Meehan [:dmeehan]]

:emz could you add https://hg.mozilla.org/mozilla-central/rev/01a7a1c27f90 to the uplift stack here for ESR128?
Otherwise, there will be conflicts when later uplifting Bug 1946105

Comment 20

[Emma Zühlcke [:emz]]

Attachment: Bug 1866661, r=hjones,mak

Original Revision: https://phabricator.services.mozilla.com/D235457

Comment 21

[Emma Zühlcke [:emz]]

Attachment: Bug 1866661 - Tests, r=hjones,mak

Original Revision: https://phabricator.services.mozilla.com/D235760

Comment 22

[Emma Zühlcke [:emz]]

Sorry, I missed that patch when requesting uplifts. The patch stack should be up to date now. Thanks!

Comment 23

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/2ea9e02fdb99
https://hg.mozilla.org/releases/mozilla-esr128/rev/bb9e1ee9dfb3

Comment 24

[Daniel Veditz [:dveditz]]

Attachment: advisory.txt