1874560 - (CVE-2024-5022) iOS Firefox Focus file:// URI address bar spoofing

Status: RESOLVED FIXED

(Focus :: Security: iOS, defect)

Description

[James Lee]

We are able to spoof address bar of iOS Firefox Focus with file:// URI as if we are on https.

This is worse than some spoof issues like https://bugs.chromium.org/p/chromium/issues/detail?id=809062 since file:// part is not viewable by users but only facebook.com just like when we are on https.

Comment 1

[James Lee]

Attachment: 1874560.html

Please Tap on Genius Cool Cat to reproduce this issue.

Comment 2

[James Lee]

this doesn't work with other URIs like about://, data:// etc.

Comment 3

[James Lee]

Attachment: RPReplay_Final1705761043.mp4

Comment 4

[Andrew McCreight [:mccr8]]

The URL bar does have the crossed out shield which I guess means not secure? But otherwise this looks fairly convincing from the video.

Comment 5

[James Lee]

That's tracking protection, please tap on that to check SSL lock with secure.

Comment 6

[Andrew McCreight [:mccr8]]

Ah, right. Sorry for the confusion.

Comment 7

[James Lee]

No problem, I'll add the video of that too.

Comment 8

[James Lee]

Ah, SSL lock with secure is already shown in the demo video 0:04, sorry for the confusion.

Comment 9

[mreagan]

Hi James, just to clarify and make sure I'm understanding: the issue here is that the URL shown in the address bar is incorrect on Focus (and has been spoofed), is that correct? I noticed there were some comments regarding the SSL lock and wanted to just double-check whether there were any other security issues involved. Thank you

Comment 10

[James Lee]

Hi mreagan, that's correct and it's a same bug that allows to spoof SSL lock as secured too (Full Address bar Spoof with SSL lock enabled).

Please test with https://bugzilla.mozilla.org/attachment.cgi?id=9372707 after logged in bugzilla on Focus.

Comment 11

[Razvan Litianu]

hey James, I took a look yesterday both at Firefox and Focus and I was curious how spoofing works. It seems o Firefox we don't get a callback with the file://facebook.com and I'm looking to find why so that's one first difference.

Comment 12

[James Lee]

Hi Razvan, thanks for letting me know.

That's because Focus allows to window.open() "file://facebook.com" while Firefox doesn't.

So the fix could be not allowing file:// to be opened with window.open() from Focus.

Comment 13

[Razvan Litianu]

Could I have a review on my proposed solution? https://github.com/mozilla-mobile/firefox-ios/pull/19968.

Comment 14

[mreagan]

Note: fix has been merged & backported, targeting v126

Comment 15

[Andrei Bodea[:andrei]]

Hello, can you please provide some steps to verify this issue?

Comment 16

[James Lee]

It's in comment 1 #c1: Login to bugzilla from Focus and follow the step, which is "Tap on Genius Cool Cat to reproduce this issue." with the attached 1874560.html file.

Comment 17

[Alina Moldovan]

validated this issue using Focus v126 (41601). Confirming that taping on Genius Cool Cat user is not redirected to facebook.com anymore, but the user is redirected to pwning.click URL

Comment 18

[mreagan]

[Tracking Requested - why for this release]:

Comment 19

[mreagan]

Attachment: advisory.txt