1954033 - (CVE-2025-6433) Incomplete WebAuthn implementation leads to signing of challenges without legit TLS-certificates

Status: RESOLVED FIXED

(Core :: DOM: Web Authentication, defect, P2)

Description

[Simon]

Attachment: Firefox not blocking the passkey login while having a TLS error

Steps to reproduce:

scenario:
-DNS-Spoofed Website whats you to use Passkeys to login
-User has a valid Passkey for the spoofed site.
-Phishing site sends "rpid" of spoofed site.
-Phishing site has a valid TLS-Certificate for its own Domain, but obviously not for the -Spoofed site. (Firefox recognises this and warns user about it)
-User accepts the risk for the invalid TLS-Certificate

I can provide my testing infrastructure to you to reproduce the error or i can just give you the two websites i used to generate the error.

Actual results:

When i now enter the domain of the spoofed website, im actually on the phishing site. Firefox warns me, that the TLS-Certificate is not for the domain i wanted to open. I accept the risk and enter the website. I can now use the "Login with Passkey"- Button and sign the challenge with my Passkey for the spoofed website.

Expected results:

As of the WebAuth-API specifications https://www.w3.org/TR/webauthn-2/#web-authentication-api §5 the user-agent (in this case the firefox-browser) should only relay the rpid and the relayingparty Origin (domain) to the authenticator if a secure context is established. Because the TLS-Connection cant be considerd as a secure conenction, firefox should not call the webauthn-api and relay the data. Chromium-browser throws this error:"NotAllowedError: WebAuthn is not supported on sites with TLS certificate errors.", Brave this: "NotAllowedError: WebAuthn is not supported on sites with TLS certificate errors." This the error Firefox also should return.

Comment 1

[John Schanck [:jschanck]]

Attachment: Bug 1954033 - disallow WebAuthn when some certificate error overrides are used. r=keeler

WebAuthn is allowed in secure contexts, but the specification adds a further
restriction that on the web "this only includes [secure contexts] accessed via
a secure transport (e.g., TLS) established without errors." We had previously
allowed WebAuthn when a certificate error override was used in establishing the
channel. This patch disallows WebAuthn when an untrusted issuer or domain
override is used. We continue to allow WebAuthn when a validity period override
is used.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/524b35624e79
disallow WebAuthn when some certificate error overrides are used. r=keeler

Comment 3

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Backed out for causing wpt failures @ webauthn/createcredential-nested-frame.https.html:

• Push with failures
• Failure log

[task 2025-03-18T06:05:56.304Z] 06:05:56     INFO - TEST-UNEXPECTED-FAIL | /webauthn/createcredential-nested-frame.https.html | navigator.credentials.create({publicKey}) in a javascript url should should succeed. - assert_equals: expected "OK" but got "Error: SecurityError: The operation is insecure."
[task 2025-03-18T06:05:56.304Z] 06:05:56     INFO - @https://web-platform.test:8443/webauthn/createcredential-nested-frame.https.html:39:20

Followed by three similar failures.

Comment 4

[Pulsebot]

Backout by [e-mail]:
https://hg.mozilla.org/mozilla-central/rev/539463c58823
Backed out changeset 524b35624e79 for causing wpt failures @ webauthn/createcredential-nested-frame.https.html CLOSED TREE

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

There is an r+ patch which didn't land and no activity in this bug for 2 weeks.
:jschanck, could you have a look please?
If you still have some work to do, you can add an action "Plan Changes" in Phabricator.
For more information, please visit BugBot documentation.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/eac81faadaaa
disallow WebAuthn when some certificate error overrides are used. r=keeler

Comment 7

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/eac81faadaaa

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:jschanck, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox139 to wontfix.

For more information, please visit BugBot documentation.

Comment 9

[Tom Ritter [:tjr]]

Attachment: advisory.txt

Comment 10

[Tom Ritter [:tjr]]

Attachment: advisory.txt