1892638 - Vulnerability - a website could detect opening the browser devtools with 100% accuracy due to a bug in previewers.js

Status: RESOLVED FIXED

(DevTools :: Console, defect, P3)

Description

[matan.honig2]

Attachment: POC.html

Firefox: 124.0.2 FedoraKDE38
A website could use a simple technique (simple console.log) to detect if the user has the DevTools open.
The file source/devtools/server/actors/object/previewers.js (lines 174-198) has this code:

 RegExp: [...
      const str = DevToolsUtils.callPropertyOnObject(obj, "toString");
...
  ],

  Date: [...
      const time = DevToolsUtils.callPropertyOnObject(obj, "getTime");
...  ],

That uses DevToolsUtils.callPropertyOnObject that calls the function toString when displaying RegExp, and the function getTime when displaying a Date. Both called on the original object from the debugger scope, and both only called when user open the developer console. So to exploit this, a website just needs to do this (both options in the POC):

const d = new Date()
d.getTime = ()=>{console.log("devtools detected");}
console.log(d)

That information can be used to track users, and block users that open it, or worse, creating a different site for users with developer tools (e.g. infinity console.log %c{wikipedia} with huge CSS to crash the computer), and users without (e.g. with all tracking, ads and possibly any virus/miner you want)

Comment 1

[matan.honig2]

Attachment: POC-crasher.html

This is another POC that's acting as a wall between another website and the user. It uses the same option as the previous POC, but this time, if DevTools detected, it will create huge amount of output in the console, and possibly even disable it (or crash the DevTools itself). This POC focus more on the possible effects of this vulnerability

Comment 2

[Daniel Veditz [:dveditz]]

This is annoying and could let a malicious page try to avoid observation, but it's not itself an attack on users (a vulnerability) so we can un-hide this

Comment 3

[Daniel Veditz [:dveditz]]

Jan: why do we call the functions defined by the web page here? Could this be made optional and off by default?

custom toString() makes some sense to me, but why getTime()?

Comment 4

[Jan Honza Odvarko [:Honza] (always need-info? me)]

Ah, it would be great to address this issue, as developers have frequently requested improvements to the detection of devtools.

Alex, this was added as part of work on WebReplay patch by Brian. How important is that at this point?

Honza

Comment 5

[Alexandre Poirot [:ochameau]]

(In reply to Jan Honza Odvarko [:Honza] (always need-info? me) from comment #4)

Alex, this was added as part of work on WebReplay patch by Brian. How important is that at this point?

That patch didn't really change the way for queries the date time.
We were already calling getTime before that patch:
https://searchfox.org/mozilla-central/rev/f9580519b8330941c127f56757f7ec6401a96568/devtools/server/actors/object/utils.js#297

But this is a know issue, we have a couple of duplicates.
See bug 1789258 comment 4 for a mitigation. The preview of objects are weak and should avoid at all cost triggering any JS code.
This is wrong as it allows to detect devtools, but also wrong for the debugger as it can trigger code and breakpoints in unexpected ways...

Now, I wish we could rather work on bug 1876084, which would get rid of all that problematic code, in favor of a more performant C++ code,
which would take care of avoiding triggering any JS code.

Comment 6

[Daniel Veditz [:dveditz]]

It's unfortunate that there are a lot of ways to detect dev tools being open, and while we'd like to fix and reduce them it's a known general problem that we are not going to award a bounty for.

Comment 7

[matan.honig2]

Understandable. While it could be seen as an attack on user freedom, which Mozilla values and aims to protect (ensuring users can safeguard themselves and trust their browser), it is not a classic attack on Firefox itself.

Comment 8

[Alexandre Poirot [:ochameau]]

Attachment: Bug 1892638 - [devtools] Rename WebConsoleActor.parentActor attribute to targetActor.

Comment 9

[Alexandre Poirot [:ochameau]]

Attachment: Bug 1892638 - [devtools] Rename StyleSheetsActor.parentActor attribute to targetActor.

Comment 10

[Alexandre Poirot [:ochameau]]

Attachment: Bug 1892638 - [devtools] Expose a `targetGlobal` attribute on all target actors.

This helps various actors retrieve the global object:

• a Window for any WindowGlobal targets,
• a Sandbox for content process targets,
• a Worker global scope for worker targets,
• a Sandbox for the web extension content script targets (to be added soon).

Comment 11

[Alexandre Poirot [:ochameau]]

Attachment: Bug 1892638 - [devtools] Avoid triggering any page JS when previewing RegExp and Date.

Comment 12

[Alexandre Poirot [:ochameau]]

Here is another handy example:
data:text/html,<script>let r = / /; r.toString = ()=> {alert("called")}; window.onclick = () => console.log(r);</script>

For RegExp and Date, we can actually query the native methods, the last patch of this queue is doing that.
The previous changesets are cleanups.

https://treeherder.mozilla.org/jobs?repo=try&revision=d238b1c7658c07dc4e2962174f93d7d94c66594e

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0f1e9d13170a
[devtools] Rename WebConsoleActor.parentActor attribute to targetActor. r=devtools-reviewers,nchevobbe
https://hg.mozilla.org/integration/autoland/rev/af8a2c66b412
[devtools] Rename StyleSheetsActor.parentActor attribute to targetActor. r=devtools-reviewers,nchevobbe
https://hg.mozilla.org/integration/autoland/rev/646f8b499e3d
[devtools] Expose a `targetGlobal` attribute on all target actors. r=devtools-reviewers,nchevobbe
https://hg.mozilla.org/integration/autoland/rev/8f0b3000a74c
[devtools] Avoid triggering any page JS when previewing RegExp and Date. r=devtools-reviewers,nchevobbe

Comment 14

[tszentpeteri]

https://hg.mozilla.org/mozilla-central/rev/0f1e9d13170a
https://hg.mozilla.org/mozilla-central/rev/af8a2c66b412
https://hg.mozilla.org/mozilla-central/rev/646f8b499e3d
https://hg.mozilla.org/mozilla-central/rev/8f0b3000a74c

Comment 15

[erosman [:erosman]]

I can confirm that for example streamruby is no longer detecting the Dev Tools in the latest Nightly 20241003213146.

Comment 16

[erosman [:erosman]]

For reference, I came across another site that detects Dev Tools.
This one affects the Console tab.
Example:
https://stmruby.com/2ssioxncsm0s.html

Script:
https://streamruby.com/js/devtools-detector.js

Comment 17

[Thorin [:thorin]]

(In reply to Daniel Veditz [:dveditz] from comment #6)

It's unfortunate that there are a lot of ways to detect dev tools being open, and while we'd like to fix and reduce them it's a known general problem that we are not going to award a bounty for.

I have one PoC I'm 99.99% sure you can't fix without some major re-engineering (but IANAE) - and it's worked flawlessly for the last 5+ years without changes - do you want me to disclose it - do you want it in a confidential bug (so malicious websites don't learn of it)? Please advise