1903187 - (CVE-2024-7529) Security bug Clickjacking to allow permission using datepicker

Status: VERIFIED FIXED

(Toolkit :: PopupNotifications and Notification Bars, defect)

Description

[Hafiizh]

Attachment: bandicam 2024-06-18 11-05-54-099.mp4

when selecting a date on the datepicker and the datepicker closes because it changes focus to another input this causes clickjacking at the permission prompt

steps to reproduce:

1. open dtclickjacking.html
   2.do many Click on "next month" button

Operating System : Windows 10
Firefox version : Firefox Developer version 128.0b4 (64-bit)

Comment 1

[Hafiizh]

Attachment: dtclickjacking.html

Comment 2

[Emma Zühlcke [:emz]]

Talked about this with Gijs, we suspect that the timeShown property used for the clickjacking protection is set too early and not close enough to the actual panel show. If you look at https://searchfox.org/mozilla-central/rev/8011b6325f7ce05d228a3cdefd45d74fb98ee7b4/toolkit/modules/PopupNotifications.sys.mjs#1297,1369 you can see that in the first marked line we set timeShown. On the second marked line the actual panel show happens (popupshown). We should check if moving the timeShown assignment into that listener fixes the issue.

We weren't able to reproduce it ourselves, potentially because our hardware is faster and the panel opens up faster. There is also a transition / animation for the panel showing which may further slow down things.

Comment 3

[Daniel Veditz [:dveditz]]

Do we know the length of time for the animation? If so we should add that time to the default timeout. It's not fully visible during the transition so that bit shouldn't count against the delay value.

I couldn't reproduce either -- my initial clicks on the permission prompt were inactive and did nothing. Note: I had to play with the width of my window to get the click targets to line up. Obviously won't work in a real attack, but I assume you could probably calculate resolutions and screen geometries and platforms to get pretty close in the general case.

Comment 4

[Daniel Veditz [:dveditz]]

Hafiish: what kind of system are you running the PoC on in the movie? Is it old/slow?

Comment 5

[Hafiizh]

Attachment: spec1.jpg

i used HP elitebook 830 G6 with specification:
Processor: Intel(R) Core(TM) i7-8565U CPU @ 1.80GHz 1.99 GHz
Installed RAM : 16,0 GB (15,8 GB usable)
System type: 64-bit operating system, x64-based processor

Windows specifications:
Edition: Windows 10 Pro
Version: 22H2
OS build: 19045.4529
Experience: Windows Feature Experience Pack 1000.19058.1000.0

Comment 6

[Hafiizh]

Attachment: spec12.jpg

Comment 7

[Emma Zühlcke [:emz]]

I don't know how long the animation takes or where that code lives. I'm not convinced that adding the animation time to the timeout is a good fix. It's also possible this animation takes longer on slow machines.

I'll check if we can move timeshown even close to actual panel now. I recall we tried something like this in the past and ran into issues with prompts / the timeout breaking, so we need to be careful.

Comment 8

[Emma Zühlcke [:emz]]

Could you test if you can still reproduce with this Firefox build: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/LwNmAd7uRXW2N6eHSj1Feg/runs/0/artifacts/public/build/target.zip
To run it just extract the zip and execute firefox.exe.

If the issue persists with this build we most likely need a more general solution for panels overlaying permission prompts. We should hide the datepicker once the permission prompt appears. Bug 1901685 is doing some groundwork for that.

Comment 9

[Hafiizh]

Attachment: bandicam 2024-07-02 21-19-08-395.mp4

i cannot reproduce it

Comment 10

[Emma Zühlcke [:emz]]

Attachment: Bug 1903187, r=Gijs!

Comment 11

[Emma Zühlcke [:emz]]

Thanks Dan! I'll land this after the soft code freeze.

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ebb04323fe33
r=Gijs

Comment 13

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/ebb04323fe33

Comment 14

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:pbz, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox129 to wontfix.

For more information, please visit BugBot documentation.

Comment 15

[Emma Zühlcke [:emz]]

Let's leave this in Nightly for a bit longer before uplifting. I want to mitigate the risk of regressions. I've set a reminder in 7 days.

Comment 16

[Emma Zühlcke [:emz]]

Comment on attachment 9410842 [details]
Bug 1903187, r=Gijs!

Beta/Release Uplift Approval Request

• User impact if declined: Clickjacking on permission prompts via datepicker
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: See comment 0
  Note that engineering couldn't reproduce the original issue, but it's worth trying again. Overall we should make sure that the patch didn't break permission prompts in any way - particularly:

1. accepting a permission prompt during the first 500ms of it showing should not be possible
2. After 500ms permission prompts should be acceptable / rejectable via the buttons.

• List of other uplifts needed: None
• Risk to taking this patch: Medium
• Why is the change risky/not risky? (and alternatives if risky): Medium risk since we're changing how the PopupNotifications security delay is calculated. The delay disables the accept / reject buttons. Introducing a bug in that logic would mean the buttons can not be used and the prompt can not be closed / accepted properly and permission requests can't be granted.
• String changes made/needed: none
• Is Android affected?: No

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: It's a sec-medium. No special considerations.
• User impact if declined: Clickjacking on permission prompts via datepicker
• Fix Landed on Version: 30
• Risk to taking this patch: Medium
• Why is the change risky/not risky? (and alternatives if risky): Medium risk since we're changing how the PopupNotifications security delay is calculated. The delay disables the accept / reject buttons. Introducing a bug in that logic would mean the buttons can not be used and the prompt can not be closed / accepted properly and permission requests can't be granted.

Comment 17

[Donal Meehan [:dmeehan]]

Comment on attachment 9410842 [details]
Bug 1903187, r=Gijs!

Approved for 129.0b6

Comment 18

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/4c5622948d31

Comment 19

[Donal Meehan [:dmeehan]]

Comment on attachment 9410842 [details]
Bug 1903187, r=Gijs!

Approved for 128.1esr.

Comment 20

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/c22e1c08561f

Comment 21

[Donal Meehan [:dmeehan]]

:pbz, this doesn't graft cleanly to ESR115 due to Bug 1872993. Could you attach a rebased patch?

Comment 22

[Emma Zühlcke [:emz]]

Attachment: Bug 1903187 - ESR 115, r=Gijs!

Comment 23

[Emma Zühlcke [:emz]]

I've attached a patch for ESR 115, just waiting for review.

Comment 24

[BugBot [:suhaib / :marco/ :calixte]]

A patch has been attached on this bug, which was already closed. Filing a separate bug will ensure better tracking. If this was not by mistake and further action is needed, please alert the appropriate party. (Or: if the patch doesn't change behavior -- e.g. landing a test case, or fixing a typo -- then feel free to disregard this message)

Comment 25

[Daniel Bodea [:danibodea]]

I cannot reproduce this issue on may main system, in an "affected" build either: Tested in Beta v128.0b4 and Devedition v128.0b4, Release v128.0 or ESR v115.13.0esr. This being considered, I cannot verify the fix on my main system.
System specs:
Windows 10
AMD Ryzen 7 2700X
16.0 GB
AMD RX580

I've managed to reproduce on a lower-end PC, but the reproduction was inconsistent on both affected and fixed builds. I do not know how timing could influence this behavior, but it can still be reproduced on fixed builds at quite the same rate as on the unaffected builds.
System specs:
Windows 10
AMD FX(tm)-8320 Eight-Core Processor
16.0 GB
NVIDIA GT710

Hi Hafiizh! Thank you for the testing in the try build! Could you please take a few minutes to test this fix in the following builds?

1. Nightly130 https://archive.mozilla.org/pub/firefox/nightly/2024/07/2024-07-18-21-47-49-mozilla-central/firefox-130.0a1.en-US.win64.zip
2. Beta129 https://archive.mozilla.org/pub/firefox/candidates/129.0b6-candidates/build1/win64/en-US/firefox-129.0b6.zip
3. ESR128 https://archive.mozilla.org/pub/firefox/candidates/128.0esr-candidates/build2/win64/en-US/firefox-128.0esr.zip

In my testing, the issue would still inconsistently reproduce in fixed builds and unfixed builds. Thanks!

Comment 26

[Hafiizh]

i cannot reproduce in Nightly130 , Beta129 , ESR128

Comment 27

[Hafiizh]

Attachment: bandicam 2024-07-20 05-44-33-124.mp4

Comment 28

[Hafiizh]

Attachment: bandicam 2024-07-20 05-43-33-127.mp4

Comment 29

[Hafiizh]

Attachment: bandicam 2024-07-20 05-42-25-457.mp4

Comment 30

[Daniel Bodea [:danibodea]]

Thank you very much for the confirmation testing done on your system, Hafiizh!
Based on the reporter's confirmation I will close this issue as verified.

Comment 31

[Emma Zühlcke [:emz]]

This is ready to be uplifted to ESR 115.

I need to investigate why QA can still reproduce, but the patch strictly makes things better so we should uplift it anyway.

Comment 32

[Donal Meehan [:dmeehan]]

Comment on attachment 9410842 [details]
Bug 1903187, r=Gijs!

Approved for 115.14esr

Comment 33

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/b1708d77b8ef

Comment 34

[Daniel Bodea [:danibodea]]

Hi again, Hafiizh! Would you be kind enough to verify the same fix in the final channel? Thank you for your contribution!

• ESR115.14.0esr: https://archive.mozilla.org/pub/firefox/candidates/115.14.0esr-candidates/build1/win64/en-US/firefox-115.14.0esr.zip

Comment 35

[Hafiizh]

Attachment: bandicam 2024-07-31 14-43-54-141.mp4

i cannot reproduce poc in 115.14.0esr (64-bit)

Comment 36

[Daniel Bodea [:danibodea]]

I am setting firefox-esr115 flag to verified. Thanks!

Comment 37

[Tyson Smith [:tsmith]]

Attachment: advisory.txt

Comment 38

[Tyson Smith [:tsmith]]

Attachment: advisory.txt