navigator.mozTCPSocket call from a compromised content process could bypass network sandbox (and browser proxy settings)
Categories
(Core :: Networking, defect)
Tracking
()
People
(Reporter: andrew.kemeklis, Unassigned)
Details
(Keywords: reporter-external, Whiteboard: [client-bounty-form])
A compromised content process may elevate to eSystemPrincipal JS Principal by modifying memory, and then use navigator.mozTCPSocket to open a proxy bypassed TCP connection.
|
||
Comment 1•20 days ago
|
||
Automatic triage (under development): deduplication
No validation or verification has been performed.
This issue has been determined to be a duplicate of bug 2017857.
Both bugs report that a compromised content process can use the mozTCPSocket IPC (PTCPSocket) to have the unsandboxed parent process open TCP connections for it, getting around the network sandbox. The fix makes the parent reject these requests in TCPSocketParent::RecvOpen unless the dom.tcpsocket_in_child.enabled pref is set, which it is not by default.
|
||
Comment 2•20 days ago
|
||
of course bug 2017857 was fixed months ago (Firefox 150) so maybe you found a different bug, but there's no way to tell
- you don't specify what version of the browser is affected
- you have only a vague description of the bug
- there is no working POC to demonstrate it is real (a Firefox patch to simulate a compromised process is acceptable)
This is not a valid Bug Bounty submission even if it didn't sound like a duplicate.
|
Reporter | |
Comment 3•20 days ago
|
||
Hi Daniel, it looks like it was already fixed. I created this submission on request from the discussion in https://bugzilla.mozilla.org/show_bug.cgi?id=2071647 in which I exploited the 2024 version of Firefox with a heap use-after-free I found, and then used the mozTCPSocket feature which was still exposed back then.
|
|
||
Comment 4•1 day ago
|
||
(In reply to andrew.kemeklis from comment #3)
Hi Daniel, it looks like it was already fixed. I created this submission on request from the discussion in https://bugzilla.mozilla.org/show_bug.cgi?id=2071647
Got it thanks! That's the kind of context I was looking for in comment 2. I had even been involved in bug 2071647, but there are so many bug reports I didn't connect the two. And this could have just as easily been triaged by someone who hadn't seen 2071647.
|
|
Reporter | |
Comment 5•1 day ago
|
||
(In reply to Daniel Veditz [:dveditz] from comment #4)
(In reply to andrew.kemeklis from comment #3)
Hi Daniel, it looks like it was already fixed. I created this submission on request from the discussion in https://bugzilla.mozilla.org/show_bug.cgi?id=2071647
Got it thanks! That's the kind of context I was looking for in comment 2. I had even been involved in bug 2071647, but there are so many bug reports I didn't connect the two. And this could have just as easily been triaged by someone who hadn't seen 2071647.
Got it! 👍
Description
•