1946122 - (CVE-2025-54145) iOS Firefox QR Code Scanner allows to run internal URI, localhost attack vectors and arbitrary schemes

Status: VERIFIED FIXED

(Firefox for iOS :: General, defect)

Description

[James Lee]

Attachment: test1.png

1. firefox:// URI and internal URI shouldn't be executed inside Firefox internally through QR Code Scanning but this is allowed.

internal URI can't be opened alone through QR Code scanning but it's allowed when you run it through firefox:// URI. This is similar and another version of bug 1868005

Please scan test1.png with iOS Firefox

2. localhost scheme that could be used for dangerous exploits like bug 1850019 shouldn't be executed inside Firefox internally through QR Code Scanning but this is allowed.

bug 1850019 is localhost reader mode feature abusing bugs http://localhost:6571 which can't be opened from open-url or in iOS Firefox from web, but only this way for possibly further exploitation chain purpose with http://localhost:6571 reader mode vulnerabilities.

Please scan test2.png with iOS Firefox

3. Arbitrary schemes like tel://

QR Code Scanning also allows to execute any arbitrary scheme.

Please scan test3.png with iOS Firefox

I'll add further details to follow up.

Comment 1

[James Lee]

Attachment: test2.png

Comment 2

[James Lee]

Attachment: test3.png

Comment 3

[James Lee]

The correct way to fix this and related bug 1946062 is to ONLY allow http/https for QR Code scanning and parameter for firefox://open-text?text=[param] like the fix for bug 1705094

Comment 4

[Daniel Veditz [:dveditz]]

In principle, the QR reader should be allowed to do what clicking a link could do so this is probably just a dupe of bug 1946062. But we may find that after fixing bug 1946062 that it turns out the QR code reader went its own way so I'll make it "depends on" for now.

Comment 5

[James Lee]

Yes, this has its own unique path (see also https://bugzilla.mozilla.org/show_bug.cgi?id=1868005#c9) and we can confirm that as we are not using firefox:// URI for second and third example.

Comment 6

[mreagan]

I confirmed that the way the fix was implemented for https://bugzilla.mozilla.org/show_bug.cgi?id=1946062 should also resolve this issue, as the fix is applied at the point at which we create the route for the incoming link which is also triggered for scanned QR codes, and should prevent any about://, localhost:// or other similar text from opening directly as a webpage.

Comment 7

[mreagan]

(In reply to James Lee from comment #3)

The correct way to fix this and related bug 1946062 is to ONLY allow http/https for QR Code scanning and parameter for firefox://open-text?text=[param] like the fix for bug 1705094

Just as a clarification here, my understanding is that we should not be allowing even HTTP or HTTPS for open-text URLs. The only practical purpose that the open-text URLs have currently is for sending search text queries to Firefox from external applications.

So AFAICS the only legitimate place it is used by Mozilla is for the Share sheet when sharing a search term to Firefox for the 'Search in Firefox' action.

If anyone has concerns or objections however let me know. The fix as it's currently implemented will not even allow HTTP/HTTPS links to be opened directly via open-text URLs and I believe this is how it should be behaving.

Comment 8

[Daniel Veditz [:dveditz]]

The "bug" is a duplicate of bug 1946062 for bounty purposes, but we'll keep this as a "depends on" because the testcase may be useful in the future and in theory could have had a different handling path (as we were once surprised to be true for javascript: urls)

Matt, yeah, open-text should not open URLs of any kind.

Comment 9

[mreagan]

Attachment: advisory.txt

Comment 10

[Daniel Veditz [:dveditz]]

We have reserved CVE-2025-54145 for this issue

Comment 11

[Andrei Bodea[:andrei]]

Verified as fixed on v9000 (58916) with iPhone 15 Pro (18.5).
Confirmed with Matt that once 1946062 was verified this one can be closed too.