1879739 - (CVE-2024-31393) JavaScript URLs load when dragged to address bar, bypassing restriction on them (Potential UXSS)

Status: VERIFIED FIXED

(Firefox for iOS :: Browser, defect)

Description

[Muneaki Nishimura]

Attachment: fxios-jsurl-uxss.mov

Firefox for iOS normally disallows top-level navigation to javascript: URLs.
However, this limitation can be bypassed by drag-and-drop a javascript: URL into the address bar.
This behavior has potential use for Universal XSS attacks.

The following page is a reproduction case of this attack.
https://csrf.jp/2024/fxios-jsurl.php

In this page, when you drag a URL link, the page is switched to www.google.com.
And when you drop the link into the address bar, the script is executed on www.google.com.

Comment 1

[lmarceau]

Thank you Muneaki for reporting the issue. We are working on a WebEngine project that will as a side-effect improve how navigation is allowed/refused in our app. The current issue is yet another place where there's no scheme checks before navigation happens in the project. I'll do a quick fix for now.

For anyone following, the drag and drop is handled through this code here.

Comment 2

[lmarceau]

PR was merged, is pending tests and will be part of the 124 release. Thank you :muneaki!

Comment 3

[Frederik Braun [:freddy]]

Hey Muneaki. Nice find. We can see this as an XSS type of bug but not necessarily as UXSS. The bug requires you to drag and drop a link from the current web page (or an iframe) and not any, arbitrary web page. It also requires some user interaction. We're going to award this on the lower end of "sec-moderate" due to these circumstances. Thanks you for continuing to participate in our bug bounty program.

Comment 4

[Andrei Bodea[:andrei]]

Verified as fixed on v124 (39092) with iPhone 15 Pro (17.1.2).
When I dragged the link over the URL www.google.com was loaded and displayed correctly, there was no https://www.google.com UXSS prompt as it can be seen in the previous version where the issue was not fixed.

Comment 5

[mreagan]

Attachment: advisory.txt