1870262 - (CVE-2024-0753) HSTS policy on subdomain without includeSubDomains can bypass policy of upper domain

Status: RESOLVED FIXED

(Core :: Security: PSM, defect, P1)

Description

[Hanno Boeck]

I believe I have found a security problem in the HSTS interpretation of Firefox.

Take the following three URLs (this is a live example on a test domain of mine; I intend to keep it functional until this issue is resolved):

• https://q2.re/ has an HSTS policy with includeSubDomains.
• https://sub.q2.re/ has an HSTS policy without includeSubDomains.
• http://plain.sub.q2.re/ has no HTTPS support.

If one opens these URLs in that order, it will open the last one over unencrypted HTTP.

It appears Firefox interprets the policy on the subdomain without includeSubDomains as a signal to unset HSTS for further sub-subdomains.

In my reading of the RFC 6797, this is wrong. The policy on the apex domain - with includeSubDomains - applies to all subdomains. The policy without includeSubDomains on the subdomain only applies to that specific host. It should not have any transitive effects on further subdomains.

Notably, this even works for preloaded domains. This severely breaks expectations. When one preloads a domain, it is expected that no unencrypted access is possible.

A plausible scenario where this could lead to an attack could look like this:

• https://example.com/ has a strict HSTS policy with includeSubDomains and may even be preloaded.
• https://example.com/ sets a cookie scoped for .example.com without a secure flag. (This is not unusual - there is advice out there that the secure flag is less important if one uses HSTS. This is e.g. implied by the Mozilla Observatory scoring.)
• Attacker looks for any subdomain of example.com with an HSTS policy without includeSubDomains. (This is also not unusual. The expectation may be that includeSubDomains is only important for the apex domain.)

I quickly found a live example on a popular page (netflix.com) where all criteria apply (though I do not know if the cookie is security relevant). I have not performed a thorough search for affected pages, I expect this to be very common.

Given it is close to the end of the year, I should say that I do not plan any short-term disclosure and do not expect any handling of this issue during Christmas and New Year time.

Comment 1

[Christoph Kerschbaumer [:ckerschb]]

Dana, since you have been doing a lot of great work on HSTS recently, do you wanna take a look? Maybe it's an easy fix after all.

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: Bug 1870262 - a subdomain of any HSTS superdomain that asserts includeSubdomains is HSTS r?jschanck

Previously, the HSTS implementation would only consider the first superdomain
that had any HSTS information and use the presence or absence of the
includeSubdomains directive to determine if the subdomain was HSTS. However,
the specification actually stipulates that if any superdomain that is HSTS
asserts includeSubdomains, the subdomain is HSTS.

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Yeah, originally we interpreted the spec differently, but I agree that that reading is correct.
Seems like a sec-moderate, since it requires the site to be set up in a certain way.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a5d65b2a47ae
a subdomain of any HSTS superdomain that asserts includeSubdomains is HSTS r=jschanck

Comment 5

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/a5d65b2a47ae

Comment 6

[Ryan VanderMeulen [:RyanVM]]

This'll need rebasing if we're going to uplift to ESR115.

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:keeler, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox122 to wontfix.

For more information, please visit BugBot documentation.

Comment 8

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Comment on attachment 9368975 [details]
Bug 1870262 - a subdomain of any HSTS superdomain that asserts includeSubdomains is HSTS r?jschanck

Beta/Release Uplift Approval Request

• User impact if declined: If a site were configured in a specific but not unreasonable way, an attacker could essentially bypass HSTS and e.g. steal login cookies.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This is a small, localized change, and the implementation is well-tested.
• String changes made/needed: none
• Is Android affected?: Yes

Comment 9

[Donal Meehan [:dmeehan]]

Comment on attachment 9368975 [details]
Bug 1870262 - a subdomain of any HSTS superdomain that asserts includeSubdomains is HSTS r?jschanck

Approved for 122.0b3

Comment 10

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/0020b05af8b1

Comment 11

[Hanno Boeck]

FYI, I have submitted a talk to the nullcon conference (14th/15th march 2024 https://nullcon.net/ ) where I plan to disclose this.
That's still plenty of time, so I expect releases with the fix will be ready by then.

Comment 12

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: Bug 1870262 - a subdomain of any HSTS superdomain that asserts includeSubdomains is HSTS (ESR115) r?jschanck

Previously, the HSTS implementation would only consider the first superdomain
that had any HSTS information and use the presence or absence of the
includeSubdomains directive to determine if the subdomain was HSTS. However,
the specification actually stipulates that if any superdomain that is HSTS
asserts includeSubdomains, the subdomain is HSTS.

Comment 13

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Comment on attachment 9370811 [details]
Bug 1870262 - a subdomain of any HSTS superdomain that asserts includeSubdomains is HSTS (ESR115) r?jschanck

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: HSTS bypass
• User impact if declined: login cookies could be stolen
• Fix Landed on Version: 123
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This is a pretty straightforward change in a self-contained area of code. Also, we had a preexisting test for exactly this case (just flipped, logically).

Comment 14

[Donal Meehan [:dmeehan]]

Comment on attachment 9370811 [details]
Bug 1870262 - a subdomain of any HSTS superdomain that asserts includeSubdomains is HSTS (ESR115) r?jschanck

Approved for 115.7esr.

Comment 15

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/251e932660cc

Comment 16

[Jesse Schwartzentruber (:truber)]

Attachment: advisory.txt

Comment 17

[Hanno Boeck]

Can we make this bug public now? I'd like to have a public reference where it is described.