2049155 - RecvReloadWithHttpsOnlyException allows compromised subframe to downgrade top-level page from HTTPS to HTTP

Status: RESOLVED DUPLICATE of bug 2014104

(Core :: DOM: Security, defect)

Description

[Mohamed Mbarek]

Summary

WindowGlobalParent::RecvReloadWithHttpsOnlyException (WindowGlobalParent.cpp:1512) performs zero validation that the caller is the HTTPS-only error page. Any WindowGlobalChild in any content process -- including a compromised cross-origin subframe -- can call this to:

1. Add a session-persistent https-only-load-insecure permission for the TOP-LEVEL origin
2. Reload the TOP-LEVEL page to HTTP using GetSystemPrincipal() as triggering principal

The WebIDL gate (Document::CallerIsTrustedAboutHttpsOnlyError, Document.cpp:1500) only runs in the content-process JavaScript layer. A compromised content process bypasses it by calling SendReloadWithHttpsOnlyException() directly on the C++ WindowGlobalChild actor.

Affected Configuration

All Firefox users since HTTPS-First is enabled by default (dom.security.https_first = true).

Steps to Reproduce (conceptual)

1. User visits https://bank.com which embeds <iframe src="https://evil.com">
2. Attacker compromises the evil.com content process
3. From the compromised process, attacker calls SendReloadWithHttpsOnlyException() on the iframe's WindowGlobalChild
4. Parent process executes RecvReloadWithHttpsOnlyException:
   • Gets top-level URI via BrowsingContext()->Top()->GetCurrentURI() -> https://bank.com
   • Creates http://bank.com URI (line 1537)
   • Adds https-only-load-insecure session permission for bank.com (line 1555)
   • Navigates top-level BC to http://bank.com with system principal (line 1577-1583)
5. Bank.com now loads over HTTP for the rest of the session
6. Network attacker can MITM the HTTP connection

Root Cause

The parent handler has no validation:

• No IsTop() check (cf. other handlers that DO check: RecvUpdateDocumentTitle line 517, RecvShare line 823, RecvCheckPermitUnload line 1099 all check BrowsingContext()->IsTop())
• No check that the document is about:httpsonlyerror
• No check that the caller owns the top-level BrowsingContext

Impact

From a compromised content process (including an embedded third-party iframe):

• HTTPS-to-HTTP downgrade of the top-level page
• Session-persistent permission exception (survives tab close)
• System principal navigation bypasses CSP and other content security checks
• Enables MITM attacks when combined with a network attacker
• Affects ALL Firefox users (HTTPS-First enabled by default)

Suggested Fix

Add server-side validation in RecvReloadWithHttpsOnlyException:

if (!BrowsingContext()->IsTop()) {
    return IPC_FAIL(this, "HTTPS-only: Only top-level frames can create exceptions");
}

Optionally also verify the document URI is about:httpsonlyerror in the parent handler.

Tested on: Firefox 153.0a1 (mozilla-central)