1905843 - (CVE-2024-9392) Setting [channel|docshellLoadState|*] original uri in a (compromised) content process may be used to trigger loading of cross-origin pages in a wrong content process

Status: RESOLVED FIXED

(Core :: DOM: Navigation, defect, P2)

Description

[Olli Pettay [:smaug][[e-mail]]]

bug 1899154 is a subset of this.

We could at least make this a bit harder by comparing original uri and channel's uri in IsolationOptionsForNavigation.

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

Attachment: Bug 1905843, prevent unexpected use of result site origin, r=nika

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

Need to still audit some code/behavior.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 9410812 [details]
Bug 1905843, prevent unexpected use of result site origin, r=nika

Security Approval Request

• How easily could an exploit be constructed based on the patch?: I think it is relatively well hidden where the actual issue happens - on needs to have a compromised content process
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: Unknown
• Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?: all
• If not all supported branches, which bug introduced the flaw?: None
• Do you have backports for the affected branches?: No
• If not, how different, hard to create, and risky will they be?: I think this should be trivial to rebase. I might even work as is.
• How likely is this patch to cause regressions; how much testing does it need?: I've tried to limit the scope as much as possible, but it is not regression-risk-free.
• Is the patch ready to land after security approval is given?: Yes
• Is Android affected?: Yes

Comment 4

[Tom Ritter [:tjr] (OOTO Oct 18-26)]

Comment on attachment 9410812 [details]
Bug 1905843, prevent unexpected use of result site origin, r=nika

Approved to land and uplift

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/230299b03e10
prevent unexpected use of result site origin, r=nika

Comment 6

[Sandor Molnar[:smolnar]]

Backed out for causing build bustages @ nsContentSecurityManager.cpp

Backout link: https://hg.mozilla.org/integration/autoland/rev/1f8b95c394153cd47e44d34dd72ed2237d39fb0c

Push with failures

Failure log -> /builds/worker/checkouts/gecko/dom/security/nsContentSecurityManager.cpp:1728:17: error: use of undeclared identifier 'nsScriptSecurityManager'; did you mean 'nsIScriptSecurityManager'?

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/894b18e7cc4f
prevent unexpected use of result site origin, r=nika

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/894b18e7cc4f

Comment 9

[Olli Pettay [:smaug][[e-mail]]]

Attachment: Bug 1905843, prevent unexpected use of result site origin, r=nika

Original Revision: https://phabricator.services.mozilla.com/D215496

Comment 10

[Phabricator Automation]

beta Uplift Approval Request

• User impact if declined: Compromised content process might load cross-origin pages in it
• Code covered by automated testing: no
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: One needs to inject for example code from bug 1899154 to Firefox, rebuild and test
• Risk associated with taking this patch: medium
• Explanation of risk level: It has been a bit hard to test all the code paths locally, since this requires injecting broken code to content processes
• String changes made/needed: NA
• Is Android affected?: yes

Comment 11

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/e7c8f3ffa269

Comment 12

[Ryan VanderMeulen [:RyanVM]]

Please nominate this for ESR128 and ESR115 also. It grafts cleanly to both.

Comment 13

[Olli Pettay [:smaug][[e-mail]]]

Attachment: Bug 1905843, prevent unexpected use of result site origin, r=nika

Original Revision: https://phabricator.services.mozilla.com/D215496

Comment 14

[Phabricator Automation]

esr128 Uplift Approval Request

• User impact if declined: Compromised content process might load cross-origin pages in it
• Code covered by automated testing: no
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: One needs to inject for example code from bug 1899154 to Firefox, rebuild and test
• Risk associated with taking this patch: medium
• Explanation of risk level: It has been a bit hard to test all the code paths locally, since this requires injecting broken code to content processes
• String changes made/needed: NA
• Is Android affected?: yes

Comment 15

[Olli Pettay [:smaug][[e-mail]]]

Attachment: Bug 1905843, prevent unexpected use of result site origin, r=nika

Original Revision: https://phabricator.services.mozilla.com/D215496

Comment 16

[Phabricator Automation]

esr115 Uplift Approval Request

• User impact if declined: Compromised content process might load cross-origin pages in it
• Code covered by automated testing: no
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: One needs to inject for example code from bug 1899154 to Firefox, rebuild and test
• Risk associated with taking this patch: medium
• Explanation of risk level: It has been a bit hard to test all the code paths locally, since this requires injecting broken code to content processes
• String changes made/needed: NA
• Is Android affected?: yes

Comment 17

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/2057fd30ca70

Comment 18

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/603c9c5fec62

Comment 19

[Sandor Molnar[:smolnar]]

Backed out from esr115 for causing build bustages @ nsContentSecurityManager

Backout link: https://hg.mozilla.org/releases/mozilla-esr115/rev/db45208786822204bc7706a668c4da76b555e01c

Failure log -> ERROR - /builds/worker/checkouts/gecko/dom/security/nsContentSecurityManager.cpp:1850:32: error: no member named 'IsHttpOrHttpsAndCrossOrigin' in 'nsScriptSecurityManager'

Comment 20

[Dianna Smith [:diannaS]]

:smaug can you take a look at the esr115 failures?

Comment 21

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/c8629e30ae3c

Comment 22

[Jason Kratzer [:jkratzer]]

Attachment: advisory.txt

Comment 23

[Jason Kratzer [:jkratzer]]

Attachment: advisory.txt