1916659 - (CVE-2024-9397) No clickjacking delay for the Directory Upload prompt

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Shaheen Fazim]

Attachment: poc.html

Firefox has implemented delays to counter clickjacking attacks on various UI prompts. However, during testing, the directory upload prompt does not include this delay. An attacker could create an engaging website that involves a clicking game, where the user repeatedly clicks in the same location. This could trigger two prompts: one for the OS's directory upload (where the "Upload" button is preselected and active) and another Firefox prompt. Without a delay in the browser's prompt, the user could unknowingly upload all their files to the attacker's site. See demo.

I demonstrated this on a macOS machine, though the same prompt on Windows also lacks this security measure. While the Windows file chooser may appear in different areas depending on user last placement, the macOS prompt consistently opens in a predictable center location every time.

Steps to reproduce:

1. Download the attached poc.html and popup.html files.
2. Open the poc.html file in the latest macOS Firefox browser.
3. Click on 'Play Game' and repeatedly click on the red button to see that the user's directory is unknowingly uploaded.

Comment 1

[Shaheen Fazim]

Attachment: popup.html

Comment 2

[Shaheen Fazim]

Attachment: demo.mp4

Video Demonstration.

Comment 3

[Andrew McCreight [:mccr8]]

The test case uses webkitdirectory in case that matters.

Comment 4

[Daniel Veditz [:dveditz]]

Isn't this the same OS dialog as the normal single-file upload case? I don't know that we can implement a delay in that.

Not visible (to me) in your movie is the extra confirmation prompt about uploading the whole directory. That one's ours and does seem to be missing the delay.

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

This is about <input type=file>, not the File APIs

Comment 6

[Andreas Farre [:farre]]

Do we know enough to set a severity on this :smaug?

Comment 7

[Andrew McCreight [:mccr8]]

Paul, is this something you might be interested in looking at? The setup is a bit janky, but if you pull it off it seems bad, and hopefully we have standard fixes for this thing. Thanks.

Comment 8

[Emma Zühlcke [:emz]]

Attachment: Bug 1916659, r=Gijs!

Comment 9

[Emma Zühlcke [:emz]]

Attachment: Bug 1916659, r=Gijs!

Original Revision: https://phabricator.services.mozilla.com/D222629

Comment 10

[Phabricator Automation]

beta Uplift Approval Request

• User impact if declined: sec-moderate clickjacking issue that exposes files from the local machine
• Code covered by automated testing: yes
• Fix verified in Nightly: no
• Needs manual QE test: yes
• Steps to reproduce for manual QE testing: See comment 0
• Risk associated with taking this patch: low
• Explanation of risk level: Low risk because the production code change is very simple.
• String changes made/needed: no
• Is Android affected?: no

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/11c65ab69a2f
r=Gijs

Comment 12

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/11c65ab69a2f

Comment 13

[Ryan VanderMeulen [:RyanVM]]

Please nominate this for ESR128 also.

Comment 14

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/8aee894dc15a

Comment 15

[Raluca Popovici, Desktop QA]

I was able to reproduce this issue on macOS 13.2.1 using Fx 130.0 -> the "Upload" button from the Firefox prompt is already active(there is no delay before activating the button). The files can be uploaded by mistake on click.
Verified fixed on macOS 13.2.1 using the treeherder builds : Fx 131.0b9 and Nightly 132.0a1(2024-09-19) -> there is a delay(~3s) before activating the "Upload" button from the Firefox prompt.

Comment 16

[Emma Zühlcke [:emz]]

Attachment: Bug 1916659, r=Gijs!

Original Revision: https://phabricator.services.mozilla.com/D222629

Comment 17

[Phabricator Automation]

esr128 Uplift Approval Request

• User impact if declined: clickjacking risk where users might involunarily expose a local directory and its files
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: yes
• Steps to reproduce for manual QE testing: comment 0
• Risk associated with taking this patch: low
• Explanation of risk level: small production code change
• String changes made/needed: no
• Is Android affected?: no

Comment 18

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/d58c0ed99efd

Comment 19

[Raluca Popovici, Desktop QA]

Verified fixed on macOS 13.2.1 using Fx 128.3.0 esr there is a delay(~ 2 - 3s) before activating the "Upload" button from the Firefox prompt.

Comment 20

[Jason Kratzer [:jkratzer]]

Attachment: advisory.txt