1970658 - (CVE-2025-6429) Unexpected URL can be loaded via embed/object elements due to non-strict YouTube URL replacement

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Masato Kinugawa]

Attachment: fx_wrong_url_loaded_via_embed.html

When loading a YouTube URL of a particular format via an <embed> or <object> element, Firefox replaces the specified URL. It is done in nsObjectLoadingContent::MaybeRewriteYoutubeEmbed : https:// github.com/mozilla-firefox/firefox/blob/4b584585f7b4ed77738aa20a2d1bc2ba9e8a464f/dom/base/nsObjectLoadingContent.cpp#L508-L603

Here, the first & string contained in the specified URL is replaced with ?: https://github.com/mozilla-firefox/firefox/blob/4b584585f7b4ed77738aa20a2d1bc2ba9e8a464f/dom/base/nsObjectLoadingContent.cpp#L578
However this replacement is not strct and allows fetching unexpected hosts.

The issue can be reproduced via the following HTML. If the PoC works correctly, example.com host instead of the expected YouTube host will be embedded in the subframe.

<embed src="https://example.com&@www.youtube.com/v/lG7U3fuNw3A"></embed>

or

<object data="https://example.com&@www.youtube.com/v/lG7U3fuNw3A"></object>

This can result in embedding unexpected hosts, even if the application embeds the URL from the embed/object tag after validating user-specified URL correctly.

The following is an example of content being loaded from an unexpected host even though the client-side JavaScript validates the specified host and protocol properly.
https://vulnerabledoma.in/fx_wrong_url_loaded_via_embed.html

Comment 1

[Emma Zühlcke [:emz]]

The URI/URL seems to be parsed correctly, so this may be a bug in DOM.

Comment 2

[Andrew McCreight [:mccr8]]

From reading bug 1258053, it looks like this was related to the Flash plugin so maybe we can remove it? I'm not entirely sure of what the security implications are.

Comment 3

[Andrew McCreight [:mccr8]]

Interestingly, this rewriting is controlled by a pref and even has a use counter. The use counter only records if a URL could be rewritten, not that there was actually any change from it, but we're getting like 100k hits per day. I haven't looked at use counters before, but that sounds like a lot.

Comment 4

[Masatoshi Kimura [:emk]]

We should use pathQueryRef instead of the entire spec.

Comment 5

[Masatoshi Kimura [:emk]]

Attachment: Bug 1970658 - Automated test. r?#dom-core!

Comment 6

[Masatoshi Kimura [:emk]]

Attachment: Bug 1970658 - Apply YouTube embed URL replacement to the path component. r?#dom-core!

Comment 7

[Andrew McCreight [:mccr8]]

I'll mark this as sec-moderate, as it sounds like the exploit scenario here is that you are bypassing a site restriction for validating a user-supplied URL, and I think that's what we tend to use for things in that category, like CSP bypasses. I don't think we have a specific csectype for that, however.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/7ef2c4c3642a
https://hg.mozilla.org/integration/autoland/rev/cf4ccb536244
Apply YouTube embed URL replacement to the path component. r=dom-core,farre

Comment 9

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/cf4ccb536244

Comment 10

[Masatoshi Kimura [:emk]]

Attachment: Bug 1970658 - Apply YouTube embed URL replacement to the path component. r?#dom-core!

Original Revision: https://phabricator.services.mozilla.com/D252841

Comment 11

[Donal Meehan [:dmeehan]]

:emk, could you complete the uplift request form on the beta uplift request?
It grafts cleanly to ESR128, looks like it's needed there also?

Comment 12

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined: Attackers can load a malicios website in a subframe bypassing site filters
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: N/A
• Risk associated with taking this patch: Low
• Explanation of risk level: Only reduced a range of string replacement, automated test is works loccally (not landing yet because this is a security sensitive bug and the test contains a PoC)
• String changes made/needed: No
• Is Android affected?: yes

Comment 13

[Masatoshi Kimura [:emk]]

Attachment: Bug 1970658 - Apply YouTube embed URL replacement to the path component. r?#dom-core!

Original Revision: https://phabricator.services.mozilla.com/D252841

Comment 14

[Phabricator Automation]

firefox-esr128 Uplift Approval Request

• User impact if declined: Attackers can load a malicios website in a subframe bypassing site filters
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: N/A
• Risk associated with taking this patch: low
• Explanation of risk level: Only reduced a range of string replacement, automated test is works loccally (not landing yet because this is a security sensitive bug and the test contains a PoC)
• String changes made/needed: no
• Is Android affected?: yes

Comment 15

[Masatoshi Kimura [:emk]]

Attachment: Bug 1970658 - Apply YouTube embed URL replacement to the path component. r?#dom-core!

Original Revision: https://phabricator.services.mozilla.com/D252841

Comment 16

[Phabricator Automation]

firefox-esr115 Uplift Approval Request

• User impact if declined: Attackers can load a malicios website in a subframe bypassing site filters
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: N/A
• Risk associated with taking this patch: low
• Explanation of risk level: Only reduced a range of string replacement, automated test is works loccally (not landing yet because this is a security sensitive bug and the test contains a PoC)
• String changes made/needed: no
• Is Android affected?: yes

Comment 17

[Masatoshi Kimura [:emk]]

(In reply to Donal Meehan [:dmeehan] from comment #11)

:emk, could you complete the uplift request form on the beta uplift request?
It grafts cleanly to ESR128, looks like it's needed there also?

Sorry, I didn't find the upload request form. I have filled the form now.

Comment 18

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/673c8c21944a
https://hg.mozilla.org/releases/mozilla-beta/rev/92b6dafc5f68

Comment 19

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/bd1b744a5276

Comment 20

[Tom Ritter [:tjr]]

Attachment: advisory.txt

Comment 21

[Tom Ritter [:tjr]]

Attachment: advisory.txt

Comment 22

[Masato Kinugawa]

I think the advisory is wrong. This bug rewrites a YouTube URL to a different host (e.g. from www.youtube.com to attacker.example.com).
This bug is problematic when YouTube embeds are expected.

Comment 23

[Tom Ritter [:tjr]]

Attachment: advisory.txt

Comment 24

[Acasandrei Beatrice (needinfo me)]

(In reply to Pulsebot from comment #8)

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/7ef2c4c3642a
https://hg.mozilla.org/integration/autoland/rev/cf4ccb536244
Apply YouTube embed URL replacement to the path component. r=dom-core,farre

Perfherder has detected a devtools performance change from push cf4ccb5362445e499d5f219d115333d85a4c4edf.

If you have any questions, please reach out to a performance sheriff. Alternatively, you can find help on Slack by joining #perf-help, and on Matrix you can find help by joining #perftest.

Improvements:

Ratio	Test	Platform	Options	Absolute values (old vs new)
3%	damp custom.netmonitor.requestsFinished.DAMP	linux1804-64-shippable-qr	e10s fission stylo webrender	2,577.99 -> 2,502.55

Details of the alert can be found in the alert summary, including links to graphs and comparisons for each of the affected tests.

If you need the profiling jobs you can trigger them yourself from treeherder job view or ask a performance sheriff to do that for you.

You can run all of these tests on try with ./mach try perf --alert 45690

The following documentation link provides more information about this command.

Comment 25

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/f2c78bd30a2a
https://hg.mozilla.org/integration/autoland/rev/016f194aa2e5
Automated test. r=dom-core,farre

Comment 26

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/016f194aa2e5