1923786 - Browser unresponsive (dos) ios

Status: NEW

(Firefox for iOS :: General, defect)

Description

[bharat]

go to mrnoob790.github.io/attack nd on page click 3-4 time go to google.com button then u will in other tab ur website will load slow otherwise dont load

Poc https://www.mediafire.com/file/rjrfv10e7m9s885/ScreenRecording_10-10-2024_00-28-07_1.mp4/file

Comment 1

[Andrew McCreight [:mccr8]]

Can you please attach a copy of the test case to this bug, even if it won't reproduce like that? It is difficult to do view source of a page that rapidly spam reloads and then navigates. Thanks.

Comment 2

[bharat]

Attachment: attack.html.txt

Comment 3

[bharat]

Please check i attach there and that icognito ticket in comment 7 or comment 8 can u delete or can u make that ticket private because i diclose these issue there and dveditz public the ticket 1921442

Comment 4

[Andrew McCreight [:mccr8]]

I marked comment 7 and 8 private so only people with security bug access will be able to see them. Generally, DOS bugs aren't a huge problem so we might end up unhiding this bug anyways. There are a ton of ways to DOS the browser, so it kind of depends on how severe it is.

Comment 5

[mreagan]

In testing so far I haven't been able to replicate a full DOS here, though I might be doing something incorrectly. The closest I got was by spam-clicking the button in the linked page, and then rapidly switching back and forth between tabs. In that scenario I was able to get the attack page to lock up (and it appeared to cause other tabs to avoid loading) but that state was temporary and only lasted for about ~5 seconds in my case, after which the app appeared to resume functioning normally.

Comment 6

[bharat]

See these video https://www.mediafire.com/file/6uhus1rm31r5mz6/ScreenRecording_10-12-2024_09-19-06_1.mp4/
My internet speed is 100mbps

Comment 7

[bharat]

See firefox focus

Poc video

https://www.mediafire.com/file/heco35zhzlu0vdp/ScreenRecording_10-14-2024_20-01-55_1.mp4/file

Comment 8

[bharat]

Is its ok ticket for firefox focus issue to be there or i need to create a separate one

Comment 9

[Daniel Veditz [:dveditz]]

Focus and Firefox for iOS are now built from largely the same codebase. For browser content related bugs like this let's assume they're both the same issue and will be fixed together.

Comment 10

[bharat]

Why its not come in sec bounty may i know ?

Comment 11

[bharat]

May i know why u remove its from security

Comment 12

[Daniel Veditz [:dveditz]]

comment 10: Denial of Service bugs are generally ineligible for bounties (see our bug bounty program guidelines)

comment 11: We hide security bugs to protect users from attacks, but that comes at the cost of limiting it to a small set of developers who have access to the security bugs. Unhiding low-impact DoS bugs widens the pool of people who could potentially contribute a fix

Comment 13

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:jeevans, could you have a look please?

For more information, please visit BugBot documentation.

Comment 14

[bharat]

Attachment: IMG_2259.png

But on ur bug bounty guidelines its show dos are getting bounty where restart of browser needed

Comment 15

[mreagan]

Hi @bharat, you'll need to reach out to [e-mail] for questions involving bounty rewards.

I tested this POC again and based on what I can see there doesn't appear to be a DOS attack that requires a reboot of the user's device, or one that is persistent across browser restarts. I do see that the UI in the client locks up however when this JS is run, and in some cases the browser will likely need to be quit/relaunched (note: the distinction here is between relaunching the browser vs the entire device).

Note: for me, replicating this so far appears to require clicking multiple times on the JS link and then also switching immediately to a new tab (if I, for example, just close the current tab instead, I cannot replicate). My guess is this will probably be a factor in how this is prioritized given that it's a slightly unusual set of steps that a user would need to be coerced into performing, and once they relaunched their browser the issue is resolved.

@dveditz Can you advise on the security rating for this? Thank you

Comment 16

[bharat]

Hey i know these issue is not deserve the reward just ask bcz in uper one comment dveditz say Denial of Service bugs are generally ineligible for bounties (see our bug bounty program guidelines)
Thats why i just post that pic and ask

Comment 17

[mreagan]

Note: our current severity ratings guideline (https://wiki.mozilla.org/Security_Severity_Ratings/Client) specifically mentions DOS requiring a client restart as sec-low, so I'm going to set that priority for now.

Comment 18

[Daniel Veditz [:dveditz]]

(In reply to bharat from comment #14)

But on ur bug bounty guidelines its show dos are getting bounty where restart of browser needed

That chart is talking about bugs where a browser restart does NOT stop the DoS. In addition, the baseline for those "typical" amounts assume the attack only needs normal user browsing such as a click on a link or button.