1886082 - (CVE-2024-4768) Clickjacking to allow permission via popup (window.open) and webauthn OS dialog (Windows)

Status: VERIFIED FIXED

(Toolkit :: PopupNotifications and Notification Bars, defect, P1)

Description

[Hafiizh]

Attachment: bandicam 2024-03-19 10-16-51-769.mp4

I found a clickjacking vulnerability to allow permission using window open.

steps to reproduce:

1. open https://coral-shadowed-parrot.glitch.me/clickjack.html or open clickjack.html
2. Click on "Go to Game" button
3. Do Triple Click

Operating System : Windows 10
Firefox version : Firefox Nightly version 126.0a1 (2024-03-18) (64-bit)

Comment 1

[Hafiizh]

Attachment: clickjack.html

Comment 2

[Hafiizh]

Attachment: game1.html

Comment 3

[:Gijs (he/him)]

Paul, can you take a look?

Comment 4

[Daniel Veditz [:dveditz]]

triple-click is weird, and a site telling me to do it is suspicious. I'm sure this would be successful against some people, but not enough of them to get a sec-high rating.

Comment 5

[Hafiizh]

Attachment: bandicam 2024-03-21 05-48-30-440.mp4

it can do two clicks

Comment 6

[Emma Zühlcke [:emz]]

Attachment: win11-webauth-standalone-window.m4v

I can't reproduce this issue on Windows 11. Probably because the auth prompt isn't persistent, it moves to the background when I click the Firefox window. Currently setting up a Windows 10 machine to try to reproduce it there.

Comment 7

[Emma Zühlcke [:emz]]

Attachment: webauth-doorhanger.png

I've also tested it on Windows 10 (with all updates applied) on Nightly and Firefox release. I still don't see the modal that's shown in the video. Instead I see this doorhanger.

Reporter do you know if there is there any system or Firefox setting I need to change in order to see the modal? I'm curious if this is an edge case with a specific security device and a specific configuration state.

Comment 8

[Hafiizh]

Hi Paul, can you try again? I have changed the delay of the popup window

Comment 9

[Hafiizh]

Attachment: bandicam 2024-03-27 04-06-53-722.mp4

i tested on firefox developer

Comment 10

[Hafiizh]

Hi Paul, if the first try fails then do the cancel button on the webauth dialog and refresh the webpage and do a second try. I tried it on two different notebooks and it worked, no additional configuration. i do both using windows 10

Comment 11

[Emma Zühlcke [:emz]]

I don't think the permission prompt in Firefox is the reason I can't reproduce. Your Windows installation seems to show a setup prompt for your security key. Do you have security keys attached or are you using some other device like a TPM chip or a webcam with Windows Hello?

My suspicion is that the prompt changes how the Firefox window is focused and thus causes issues with the security delay. I can get the prompt to show up in Windows 11, but there it seems to get moved into the background when I click on the Firefox window.

John, do you know under which circumstances this Windows key setup prompt shows up? I'm trying to trigger it in a Windows 10 VM.

Comment 12

[John Schanck [:jschanck]]

Paul, assuming you're using a fresh profile, you shouldn't see that doorhanger unless your Windows 10 version is less than 1903 (19H1). The other possibility is that you've set security.webauth.webauthn_enable_softoken to true.

I see the security key setup modal on Windows 10 22H2, but I wasn't able to reproduce the clickjacking example.

Comment 13

[Emma Zühlcke [:emz]]

Thanks!
I've double checked and installed all the updates. My Windows 10 VM is on Version 10.0.19045 Build 19045.
I get the Firefox doorhanger on both Nightly and Release with fresh profiles - no Windows prompt.
Is there anything else I could try, e.g. enable logging to see why we fall back to what I assume is the software token?

Edit: Do I need to have a TPM attached to the VM for the OS prompt to show?
Edit2: Passing in my TPM to the VM does not change anything.

Comment 14

[John Schanck [:jschanck]]

You could break on EnsureWinWebAuthnModuleLoaded (parent process) and see where it fails. I know some VMs intercept webauthn.dll so that they can redirect WebAuthn requests to the host, so it's possible that you aren't using the standard Windows webauthn.dll.

Comment 15

[Hafiizh]

Attachment: windows.png

the version of windows that i used

Comment 16

[Hafiizh]

Attachment: bandicam 2024-03-29 06-11-53-218.mp4

hi paul i am trying to add time on
this part

setTimeout(function() { var w = window.open( "https://coral-shadowed-parrot.glitch.me/game1.html", "Popup", "resizable,scrollbars,status" ) }, 170);

I tried setting it to 1 and the permissions didn't appear then I changed it by increasing the delay time to 100 and it didn't work and I changed it to 170 and it worked. you can try adding or subtracting the time delay. Try it on your local server, maybe this is a race condition

Comment 17

[Emma Zühlcke [:emz]]

Didn't mean to clear the NI. I'm currently setting up a Windows 10 dedicated machine to see if it reproduces there.

Comment 18

[Emma Zühlcke [:emz]]

I can reproduce on my Windows 10 installation! Suprisingly I can run one from a usb drive. The security delay is not extended because no "activate" event seems to fire when the main window is focused while the "Security key setup" prompt is shown.
The "activate" event is handled by the PopupNotifications code here and normally would extend the security delay.

Edit: I think the real problem here is that normal clicks on the main Firefox window don't go through (because the Windows prompt takes exclusive focus) but the PopupNotification can still be clicked.

Comment 19

[Emilio Cobos Álvarez (:emilio)]

(As per some local debugging, the window seems to think it's still active)

Comment 20

[Emma Zühlcke [:emz]]

Thanks for the help Emilio! I've filed Bug 1890835 for the panel appearing on top of other windows, which most likely makes it clickable even though the windows prompt is open. Maybe fixing that bug will resolve the sec issue too.

Edit: It appears that this was a bug with my local profile. Potentially caused by some prefs I had not reset from testing. The PopupNotification is not on top when testing with a fresh profile. But it can still be clicked even when the window is in modal state.

Comment 21

[Emma Zühlcke [:emz]]

Attachment: Bug 1886082, r=emilio,Gijs

Comment 22

[Emma Zühlcke [:emz]]

I've attached a patch that resolves the issue by blocking pointer events to the PopupNotifications panel when the window is not active. I've confirmed this resolves the bug by testing the PoC on my Windows 10 installation. The Windows security key setup prompt deactivates the Window and it only gets activated again once the prompt has been closed.

Thanks to :emilio for the help and the CSS rule idea!

Comment 23

[Emma Zühlcke [:emz]]

Hafiizh, I want to make sure you're aware that the code you're sharing via glitch is publicly accessible. I'm not sure how discoverable it is, but when I go to your profile I can see all your public projects, including the one you used for the PoC here. I'd recommend to keep the PoC private.

Comment 24

[Hafiizh]

I have archieved the code. To reproduce The poc open clickjack.html to your local server.

Comment 25

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/194e1edfd3be
r=Gijs,emilio

Comment 26

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/194e1edfd3be

Comment 27

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:pbz, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox126 to wontfix.

For more information, please visit BugBot documentation.

Comment 28

[Emma Zühlcke [:emz]]

Comment on attachment 9396195 [details]
Bug 1886082, r=emilio,Gijs

Beta/Release Uplift Approval Request

• User impact if declined: sec-moderate clickjacking issue affecting permission prompts, only affects Windows 10.
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: https://bugzilla.mozilla.org/show_bug.cgi?id=1886082#c0
  May need to adjust the placement of the button so it lines up with the permission prompt "accept" button.
  From my testing this does not reproduce in VMs. You need a bare metal Windows 10 installation.

Please also do some smoke testing on Windows, macOS and linux to make sure permission prompts still work as expected and the accept / deny buttons can be clicked. You can use https://permission.site for testing.

• List of other uplifts needed: None
• Risk to taking this patch: Medium
• Why is the change risky/not risky? (and alternatives if risky): The code change is quite small, but there is risk that we break permission prompts. While we don't have automated test coverage for the bug's POC, permission prompts have pretty good test coverage generally.
• String changes made/needed:
• Is Android affected?: No

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: It's a sec-moderate, no particular case for ESR consideration.
• User impact if declined: see beta-uplift request
• Fix Landed on Version: 127
• Risk to taking this patch: Medium
• Why is the change risky/not risky? (and alternatives if risky): see beta-uplift request

Comment 29

[Donal Meehan [:dmeehan]]

Comment on attachment 9396195 [details]
Bug 1886082, r=emilio,Gijs

Approved for 126.0b7

Comment 30

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/f5cf401c77c9

Comment 31

[Donal Meehan [:dmeehan]]

Comment on attachment 9396195 [details]
Bug 1886082, r=emilio,Gijs

Approved for 115.11esr.

Comment 32

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/c5a6eb53ccea

Comment 33

[Ina Popescu, Desktop QA]

Attachment: error on page.png

I encountered an unexpected error while trying to access the link provided in Comment 0 and unfortunately, I'm unable to reach https://coral-shadowed-parrot.glitch.me/clickjack.html. When attempting to open the clickjack.html page directly, I encountered the same error on coral-shadowed-parrot.glitch.me/game1.html. I've attached the error message for reference.
@Hafiizh, could you please confirm if this test case is still accessible and functional on your end?

Comment 34

[Hafiizh]

I have deleted it in public based on comment #22

Comment 35

[Hafiizh]

Attachment: clickjakx.html

i updated the poc. open clickjakx.html

Comment 36

[Hafiizh]

Attachment: clickjakx.html

Comment 37

[Ina Popescu, Desktop QA]

@Hafiizh, thank you for the test case provided.
I've replicated this issue with Nightly 126.0a1 on Windows 10 x64 following the STR from Comment 0 and Comment 10.
Verified as fixed in the latest Nightly 127.0a1 and Firefox 126.0b7 versions on the same configuration, as the issue no longer occurs.

Comment 38

[Ina Popescu, Desktop QA]

I am no longer able to reproduce this issue in Firefox 115.11.0esr on Windows 10. As a result, I've updated the flag to indicate this.

Comment 39

[Daniel Veditz [:dveditz]]

(In reply to Hafiizh from comment #34)

I have deleted it in public based on comment #22

It's good the developer confirms their own fix, but it doesn't count as a verification until someone independently confirms (like QA) :-)

Comment 40

[Jesse Schwartzentruber (:truber)]

Attachment: advisory.txt