1918853 - (CVE-2024-10465) Clipboard "paste" button persists across a tab open

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Kang Ali]

Attachment: repro_clipboard.webm

When an HTML script is executed to open google.com, an alert appears asking the user to "Paste" clipboard content. If the user selects "Paste," the clipboard content is sent to the HTML script, which is located on a different domain. This raises potential concerns of UI spoofing and clipboard hijacking, as the prompt or notification for clipboard actions appears to come from a trusted domain like google.com, but is actually from a different domain.

This vulnerability could lead to UI spoofing and clipboard hijacking, where users may not realize that the notification originates from an unrelated source and their clipboard data could be sent to unauthorized parties.

Steps to Reproduce:

1. Open : https://roomkangali.com/browser/0xClip/
2. Click button Read Clipboard
3. Observe that after the google.com page loads, an alert appears asking for "Paste" from the clipboard.
4. Click "Paste" on the alert and check that the clipboard content is sent to the HTML script on a different domain.

Test in :

Firefox Nightly : 131.0a1 (2024-08-26) (64-bit)
OS : Ubuntu

Expected Result: Clipboard-related prompts or interactions should not appear on a domain different from the one that triggered the action. Clipboard actions should be performed transparently and should not mislead the user.

Actual Result: The "Paste" alert appears on the google.com page, and if the user selects "Paste," the clipboard content is sent to the HTML script located on a different domain. This can mislead users and open potential risks of data theft or misuse of personal information.

Comment 1

[Kang Ali]

Attachment: repro_android.mp4

Testing Browser Android work

Nightly Android : 132.0a1 (Build #2016044015)
Firefox Android : 130.0 (Build #2016041319)
OS : Android 14

Comment 2

[Andrew McCreight [:mccr8]]

Please attach a test case to this bug to aid triage. Thanks.

Comment 3

[Andrew McCreight [:mccr8]]

I was able to reproduce this issue on MacOS.

Comment 4

[Kang Ali]

Attachment: index.html

this attachment script html

i test reproduce in windows and mac is work

Comment 5

[Daniel Veditz [:dveditz]]

Attachment: working testcase

Comment 6

[Daniel Veditz [:dveditz]]

Tom noted this was an issue in bug 1916831 comment 2

Comment 7

[Andrew McCreight [:mccr8]]

Hsin-Yi, who is working on async clipboard stuff while Edgar is out? Thanks.

Comment 8

[Hsin-Yi Tsai (she/her)[:hsinyi]]

(In reply to Andrew McCreight [:mccr8] from comment #7)

Hsin-Yi, who is working on async clipboard stuff while Edgar is out? Thanks.

:tschuster is the person that I immediately think about; however, I am not quite sure about Tom's recent bandwidth.

Hi Tom, would you be able to put up patches for this? I read that there's a solution per bug 1916831 comment 2. Thank you.

Comment 9

[Tom Schuster]

I think I already found this issue and it's not directly bug 1916831 comment 2. The problem is that just like with the select dropdown (bug 1909163), we didn't mark the "Paste" context menu as "tabspecific". Thus it doesn't close when the current tab/location changes.

Comment 10

[Tom Schuster]

Attachment: Bug 1918853 - Mark the Paste contextmenu as tabspecific. r?emilio

Comment 11

[Tom Schuster]

That's not to say that we shouldn't also check the active flag at some earlier point, but in my quick testing browsingContext.isActive was true during confirmUserPaste.

This does not resolve the Firefox for Android issue, and I don't have any experience with that.

Comment 12

[Andrew McCreight [:mccr8]]

(In reply to Tom Schuster (MoCo) from comment #11)

This does not resolve the Firefox for Android issue, and I don't have any experience with that.

Thank you for working on this. If this requires separate Fenix changes to fix the same test case, could you please file a new issue for that so we don't lose track of this? Thanks.

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4bb7cb20a56b
Mark the Paste contextmenu as tabspecific. r=emilio

Comment 14

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1877400

Comment 15

[Tom Schuster]

That patch should apply cleanly to ESR128.

Comment 16

[Tom Schuster]

Attachment: Bug 1918853 - Mark the Paste contextmenu as tabspecific. r?emilio

Original Revision: https://phabricator.services.mozilla.com/D222596

Comment 17

[Tom Schuster]

Comment on attachment 9426087 [details]
Bug 1918853 - Mark the Paste contextmenu as tabspecific. r?emilio

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: It might be possible to trick users into leaking their clipboard contents, because the [Paste] button appears on a page they trust.

A simple fix.

• User impact if declined: Users may accidentally expose their own private data.
• Fix Landed on Version: 132
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): One line change, that follows other similar fixes for cross-tab spoofing with dropdowns/menus.

Comment 18

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/4bb7cb20a56b

Comment 19

[Kang Ali]

yes im testing in Desktop Firefox Nightly : Version 132.0a1 (2024-09-20) (64-bit)
this patch fix

just waiting fix Firefox Nightly on android

Thanks

Comment 20

[Kang Ali]

Thank you for the reward and respect to the team for the fix, great work! 🙂
I have a questions, how long is the CVE release and payment ?

Are the planning CVE , if yes could you save credits as
Reporter credit: Kang Ali and Nur Fadhillah of Punggawa Cybersecurity

Thanks

Comment 21

[Andrew McCreight [:mccr8]]

Questions about the bug bounty program should be directed to [e-mail] and not put in bugzilla comments.

(This is however an appropriate place to specify the reporter credit.)

Comment 22

[Kang Ali]

oke thanks Andrew

Do I have to contact [e-mail] or will [e-mail] contact me later?

(This is however an appropriate place to specify the reporter credit.)
how long is the CVE release ?

Thanks

Comment 23

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/6a9bff4fb40a

Comment 24

[Bogdan Maris, Desktop Test Engineering]

Reproduced the initial issue using an old Nightly build from 2024-08-26, verified that using latest Firefox Beta 132.0b7 and latest 128ESR build across platforms (Windows 11, macOS 13 and Ubuntu 22.04) from treeherder the issues is no longer reproducible. The paste clipboard button does not appear anymore so the clipboard is not leaked anymore in the demo page.

Comment 25

[Jesse Schwartzentruber (:truber)]

Attachment: advisory.txt