1912537 - (CVE-2024-10460) Should display origin in external protocol prompt if it does not match origin displayed in URL bar (Spoofing external protocol origin using data: url)

Status: VERIFIED FIXED

(Firefox :: File Handling, defect, P1)

Description

[Shaheen Fazim]

Attachment: poc.html

Firefox's external protocol handling can be exploited to conceal the origin when opened on a data URL within an iframe. As a result, a malicious site could completely hide the origin and overlay content on top of another website, enabling spoofing attacks.

Steps to Reproduce:

1. Open the provided poc.html file in the latest version of Firefox on Windows.
2. Click the button test to verify if the origin is displayed correctly. Then, click on test spoof to observe that the origin is not shown.

Comment 1

[Shaheen Fazim]

Attachment: demo.mp4

Comment 2

[Andrew McCreight [:mccr8]]

The resulting thing is clearly a new little browser window, so there's some chance for a user to see that something is awry, and the URL bar isn't exactly wrong, but the over all effect is a bit confusing.

Comment 3

[:Gijs (he/him)]

This would need fixing in https://searchfox.org/mozilla-central/rev/e968519d806b140c402c3b3932cd5f6cd7cc42ac/toolkit/mozapps/handling/content/permissionDialog.js#110-117 .

Comment 4

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:Gijs, could you have a look please?

For more information, please visit BugBot documentation.

Comment 5

[:Gijs (he/him)]

Attachment: Bug 1912537 - adjust principal display logic for external protocol dialog, r?pbz

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/390f0dcb08c2
adjust principal display logic for external protocol dialog, r=pbz

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/390f0dcb08c2

Comment 9

[:Gijs (he/him)]

Attachment: Bug 1912537 - adjust principal display logic for external protocol dialog, r?pbz

Original Revision: https://phabricator.services.mozilla.com/D220946

Comment 10

[Phabricator Automation]

beta Uplift Approval Request

• User impact if declined: Confusing display of origin for external protocol handler prompt
• Code covered by automated testing: no
• Fix verified in Nightly: no
• Needs manual QE test: yes
• Steps to reproduce for manual QE testing: see comment 0
• Risk associated with taking this patch: Low
• Explanation of risk level: The existing code has decent test coverage and this is a relatively small JS only patch
• String changes made/needed: No
• Is Android affected?: no

Comment 11

[Daniel Bodea [:danibodea]]

I managed to reproduce this issue in Beta v131.0 (RC) and v132.0b1; the pop-up refers to the website as "this site":
"Allow this site to open the ms-calculator link with Calculator?"

I have verified this fix in Nightly v133.0a1; the pop-up refers to the website as "https://bug1912537.bmoattachments.org":
"Allow https://bug1912537.bmoattachments.org to open the ms-calculator link with Calculator?"

Testing has been performed on Windows 10. I will be closing this report. Thank you.

Comment 12

[Tom Ritter [:tjr]]

While we agree this is an issue that we can improve, this is relying highly on the small popup and navigated background page to imply that the prompt comes from the other domain. Additionally, the prompt does not actually display a misattributed origin (but rather an ambiguous 'this site'). Given these factors we will be awarding this issue a Hall of Fame entry but not a bounty.

Comment 13

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/0036938102cb

Comment 14

[Ryan VanderMeulen [:RyanVM]]

Please nominate this for ESR128 approval when you get a chance. It grafts cleanly.

Comment 15

[:Gijs (he/him)]

Attachment: Bug 1912537 - adjust principal display logic for external protocol dialog, r?pbz

Original Revision: https://phabricator.services.mozilla.com/D220946

Comment 16

[Phabricator Automation]

esr128 Uplift Approval Request

• User impact if declined: potential confusion in external protocol prompt
• Code covered by automated testing: no
• Fix verified in Nightly: yes
• Needs manual QE test: yes
• Steps to reproduce for manual QE testing: see earlier comment
• Risk associated with taking this patch: low
• Explanation of risk level: The existing code has decent test coverage and this is a relatively small JS only patch
• String changes made/needed: no
• Is Android affected?: no

Comment 17

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/30e4cd583ca2

Comment 18

[Daniel Bodea [:danibodea]]

I can also confirm this fix on Beta v132.0b8 and ESR v128.4.0esr in Windows 10. The site domain is shown correctly.

Comment 19

[Jesse Schwartzentruber (:truber)]

Attachment: advisory.txt