1868008 - iOS Firefox QR Code Scanner allows address bar spoofing

Status: RESOLVED WONTFIX

(Firefox for iOS :: General, defect)

Description

[James Lee]

Attachment: QRCode_Address_bar_Spoofing.png

We are able to spoof address bar for iOS Firefox since QR Code Scanner will run URI on same tab instead of opening new tab.

Please scan this QR Code to reproduce this issue.

Comment 1

[James Lee]

This is QR Code scanning version of https://bugzilla.mozilla.org/show_bug.cgi?id=1557763

Comment 2

[James Lee]

Please open https://pwning.click/fbloc.php on iOS Firefox and scan QR code https://pwning.click/QRCode_Address_bar_Spoofing_fb.png to reproduce this issue.

Comment 4

[Andrew McCreight [:mccr8]]

I don't have an iOS device to check this myself, but can you please explain a bit more what is going on here? Is the QR code something with an invalid port like in 1557763? What is the HTML doing on the fbloc page? Thanks.

Comment 5

[Tyson Smith [:tsmith] (Back Aug 12)]

The qr code contains https://google.com:8000

Comment 6

[James Lee]

Yes, we are using non-existent port with QR Code scanner for this issue, instead of google one please test with https://pwning.click/QRCode_Address_bar_Spoofing_fb.png and https://pwning.click/fbloc.php though to spoof as https://facebook.com

Comment 7

[Daniel Veditz [:dveditz]]

(In reply to James Lee from comment #2)

Please open https://pwning.click/fbloc.php on iOS Firefox and scan QR code https://pwning.click/QRCode_Address_bar_Spoofing_fb.png to reproduce this issue.

How are you on one page and scanning a QR code on a different page? If you find a QR code on the street then your phone won't be on a malicious page that knows what target to spoof. Agree that it's totally wrong that we've got the same broken behavior as in bug 1557763, but I'm having trouble imagining a plausible attack scenario with a coordinated page and QR code to scan.

Comment 8

[lmarceau]

Attachment: QRCode_timeout.PNG

Looked into this issue. Not sure if I understand the problem on that one and need further details. I did the following:

• The user is on a webpage and pwning.click/fbspoof.php appears in the URL bar
• The user then scans a QR code by clicking on the URL bar, select the "Scan QR code" button and scan the provided QR code (Those are 3 distinct user actions)
• The URL bar then appears to try to load the page facebook.com:8000 QR code, as indicated by a progress bar that seems stuck at loading.
• We then reach the wait time threshold for the page to load, and the request times out (see screenshot).

The user actively scans a QR code for themselves in the existing tab, which is then reflected in the URL bar. I'm not sure how that's a spoof.

Comment 9

[lmarceau]

I'll close this ticket for now. Thank you!

Comment 10

[James Lee]

Please follow https://bugzilla.mozilla.org/show_bug.cgi?id=1868008#c2 to test this issue. Microsoft is fixing this on Edge which will be released soon. We can also overcome delay issue by using other ports, I'll add that test case here as well.

Comment 12

[Daniel Veditz [:dveditz]]

We can also overcome delay issue by using other ports, I'll add that test case here as well.

were you going to add those, or are they filed in a different bug?