1974025 - (CVE-2025-10530) intent:// can bypass fido:/ URI block

Status: RESOLVED FIXED

(Firefox for Android :: WebAuthn, defect, P2)

Description

[Hafiizh]

the vulnerability is same as
https://bugzilla.mozilla.org/show_bug.cgi?id=1922357
https://issues.chromium.org/issues/401823929

the original fix is a case sensitive check on the intent, it checks for "fido" and not "FIDO".
POC link that will start FIDO activity when clicked. The file also includes links that are blocked and the console output when clicked.

The fix seams to be fairly straight forward. Use a case insensitive match.

1. open http://thundering-unruly-windflower.glitch.me/fido.html
   2, click on intent://123456...#Intent;scheme=FIDO;end link

Comment 1

[Andrew McCreight [:mccr8]]

I do see what looks like a few tests for FIDO:/ so I'm not sure why that doesn't catch a problem here.

Comment 2

[Hafiizh]

Attachment: fido.mp4

Comment 3

[Hafiizh]

Attachment: fido.html

Comment 5

[Daniel Veditz [:dveditz]]

Looks more like we're returning getSafeIntent(aUri) before we check whether the scheme is fido:, rather than it being a case-sensitive comparison. If the URL is not normalized to a lowercase scheme by the time we're doing those checks then FIDO isn't the only scheme that could have a problem!

Comment 6

[Daniel Veditz [:dveditz]]

Gela: Looks like jboek hasn't active on bugzilla for a while. Can you find an appropriate person to handle this one?

Comment 7

[Ted Campbell [:tcampbell]]

@m_kato, since you are familiar with the Android FIDO code, can you take a look at this? Thanks.

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:boek, could you have a look please?

For more information, please visit BugBot documentation.

Comment 9

[:Gela]

I've reached out to Makoto directly in case this got lost in the Bugzilla notifications :)

Comment 10

[Makoto Kato [:m_kato]]

I will look it

Comment 11

[Makoto Kato [:m_kato]]

I guess that we need to check Intent.getData().getScheme()

Comment 12

[Makoto Kato [:m_kato]]

Attachment: (secure)

Comment 13

[Makoto Kato [:m_kato]]

Attachment: Bug 1974025 - Add more tests for FIDO intent URI. r=#geckoview-reviewers

Comment 14

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:boek, could you have a look please?

For more information, please visit BugBot documentation.

Comment 15

[Makoto Kato [:m_kato]]

Comment on attachment 9499992 [details]
(secure)

Security Approval Request

• How easily could an exploit be constructed based on the patch?: When clicking a link that is fido: scheme, content can hijacking fido2 authentication. This has fixed by bug bug 1922357, but we have to consider intent URI that has fido scheme. This occurs same issue if using intent scheme with internal fido scheme.
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
• Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?: yes
• If not all supported branches, which bug introduced the flaw?: None
• Do you have backports for the affected branches?: Yes
• If not, how different, hard to create, and risky will they be?:
• How likely is this patch to cause regressions; how much testing does it need?: Nothing. we block intent uri with fido scheme. It isn't usual.
• Is the patch ready to land after security approval is given?: Yes
• Is Android affected?: Yes

Comment 16

[Makoto Kato [:m_kato]]

Comment on attachment 9499992 [details]
(secure)

Security Approval Request

• How easily could an exploit be constructed based on the patch?: When clicking a link that is fido: scheme, content can hijacking fido2 authentication. This has fixed by bug bug 1922357, but we have to consider intent URI that has fido scheme. This occurs same issue if using intent scheme with internal fido scheme.
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: Yes
• Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?: yes
• If not all supported branches, which bug introduced the flaw?: None
• Do you have backports for the affected branches?: Yes
• If not, how different, hard to create, and risky will they be?:
• How likely is this patch to cause regressions; how much testing does it need?: Nothing. we block intent uri with fido scheme. It isn't usual.
• Is the patch ready to land after security approval is given?: Yes
• Is Android affected?: Yes

Comment 17

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9499992 [details]
(secure)

sec-moderates don't need approval to land, please go ahead and do so and add a Beta uplift request when you're comfortable doing so.

Comment 18

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/f1d4ce34344c
https://hg.mozilla.org/integration/autoland/rev/63adbef13247
Check scheme into Intent data. r=geckoview-reviewers,tcampbell,nalexander

Comment 19

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/63adbef13247

Comment 20

[Makoto Kato [:m_kato]]

Comment on attachment 9499992 [details]
(secure)

Beta/Release Uplift Approval Request

• User impact if declined/Reason for urgency: When clicking a link that is fido: scheme, content can hijacking fido2 authentication. This has fixed by bug bug 1922357, but we have to consider intent URI that has fido scheme. This occurs same issue if using intent scheme with internal fido scheme.
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Low. fido: scheme is already disallowed.
• String changes made/needed: No
• Is Android affected?: Yes

Comment 21

[Makoto Kato [:m_kato]]

Comment on attachment 9499992 [details]
(secure)

Beta/Release Uplift Approval Request

• User impact if declined/Reason for urgency: When clicking a link that is fido: scheme, content can hijacking fido2 authentication. This has fixed by bug bug 1922357, but we have to consider intent URI that has fido scheme. This occurs same issue if using intent scheme with internal fido scheme.
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Low. fido: scheme is already disallowed.
• String changes made/needed: No
• Is Android affected?: Yes

Comment 22

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9499992 [details]
(secure)

Approved for 143.0b8.

Comment 23

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/ca45860fec1a
https://hg.mozilla.org/releases/mozilla-beta/rev/31cc0d3ad99f

Comment 24

[Hafiizh]

thank you.
if this bug gets a cve can the credit be given to:
hafiizh (https://www.linkedin.com/in/hafiizh-7aa6bb31) & kang ali (https://www.linkedin.com/in/mohammad-ali-syarief)?

Comment 25

[Tom Ritter [:tjr]]

Yes (although CVE reporter fields don't include links)

Comment 26

[Simon Friedberger [:simonf]]

Attachment: advisory.txt

Comment 29

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/acae9cf5f3e9
https://hg.mozilla.org/integration/autoland/rev/53e077a86239
Add more tests for FIDO intent URI. r=geckoview-reviewers,nalexander

Comment 30

[rperta]

https://hg.mozilla.org/mozilla-central/rev/53e077a86239