1988758 - intent:// can bypass fido:/ URI bock

Status: RESOLVED DUPLICATE of bug 1974025

(Firefox for Android :: WebAuthn, defect)

Description

[Arya Widyanto Utomo]

Attachment: firefox-fido-bypass.mp4

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36

Steps to reproduce:

The issue is that the original fix was never tested on intent:// URLs. The original fix is a case sensitive check on the intent, it checks for "fido" and not "FIDO". I have attached a html file whit a POC link that will start FIDO activity when clicked. The file also includes links that are blocked and the console output when clicked.

1. Open firefox android
2. Navigate to a https://kentox493.github.io/browser/fido.html
3. Click a test link (URI placeholders such as fido/intent url).
4. Observe that the browser triggers a FIDO/WebAuthn authentication prompt.

Actual results:

fido was successfully triggered by bypassing intent with uppercase scheme=FIDO

Expected results:

Fido should not be able to be triggered from a link on a website.

Comment 1

[Arya Widyanto Utomo]

Attachment: fido.html

Comment 2

[Andrew McCreight [:mccr8]]

This is just bug 1974025, which was fixed in 143. The video shows 142.