1878489 - (CVE-2024-38313) URL spoofing by abusing auto hide URL bar feature (FxiOS)

Status: VERIFIED FIXED

(Firefox for iOS :: Browser, defect)

Description

[Muneaki Nishimura]

Attachment: fxios_url_bar_spoofing.gif

When you scroll a page vertically, the URL bar is automatically hidden. And when you open a new window in this condition, the URL bar in the new window is sometimes kept hidden as well.

If the page content opened in the new window is long enough, the URL bar will reappear as you repeatedly scroll up and down. However, if the content is short, the URL bar is never displayed again until the page is reloaded.

This behavior can be abused for showing a fake address bar.

There are two ways to reproduce this attack scenario. One is easy but unstable, the other one requires some steps but stable.

Reproduction case #1 (unstable)
(1) Visit https://csrf.jp/2024/fxios-url-spoofing/
(2) Scroll down the page and tap the "Open Google" button
(3) Fake Google login page is shown in new tab but the address bar says this is "www.google.com"

Reproduction case #2 (stable)
(1) Visit https://csrf.jp/2024/fxios-url-spoofing/open_new_window.php
(2) Scroll down the page and long tap the text link
(3) Tap "Open New Tab" and "Switch"
(4) Fake Google login page is shown in new tab but the address bar says this is "www.google.com"

Comment 1

[Andrew McCreight [:mccr8]]

I haven't verified this, but the spoof looks convincing from the movie.

Comment 2

[lmarceau]

For context, there's a rework project in the pipeline to redo the whole URL bar/toolbar area. I shared this ticket with the responsible engineer working on that project, as this could be fixed at the same time.

Comment 3

[mreagan]

PR https://github.com/mozilla-mobile/firefox-ios/pull/20014 has been merged; the fix will target v127 release of Firefox iOS.

Comment 4

[Muneaki Nishimura]

Thanks for the correction. I confirmed that it has been correctly fixed.

Comment 5

[Andrei Bodea[:andrei]]

Verified as fixed on v127 (41813) with iPhone 13 Pro (15.7.1).
For both cases present in the description I was able to verify that the original and iOS toolbar is correctly displayed at the top.

Comment 6

[mreagan]

Attachment: advisory.txt