1912343 - Firefox iOS address bar can be spoofed with long subdomain

Status: RESOLVED DUPLICATE of bug 1419275

(Firefox for iOS :: General, defect)

Description

[Shaheen Fazim]

Attachment: screenshot.jpg

Firefox for iOS's address bar, when navigating to a domain with a long subdomain name, is susceptible to spoofing (eg: https://long-extended-subdomain-name-containing-many-letters-and-dashes.badssl.com ). This could result in the address bar displaying a custom domain name, potentially leading to the spoofing of the victim's browser.

Proof-of-Concept:
URL: https://firefoxaddressbarspoof.mozilla.com.your-domain.com/
Expected result: ....your-domain.com/
Actual result: firefoxaddressbarspoof.mozilla.com...

Steps to reproduce:

1. Open Firefox for iOS browser.
2. Visit any of the above-mentioned domain names. An attacker could either send the link directly or provide it through a malicious site for login, etc. When this method is employed, the Firefox browser's address bar can be spoofed to impersonate a legitimate website.

Solution: We should properly truncate the domain name within the address instead of expanding it if a long subdomain is used. Solution example: ....your-domain.com/