555472 - AuthPrompt can attach to wrong URL address

Status: RESOLVED WORKSFORME

(Core :: DOM: Core & HTML, defect)

Description

[Jordi Chancel]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; fr; rv:1.9.2.2) Gecko/20100316 Firefox/3.6.2
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; fr; rv:1.9.2.2) Gecko/20100316 Firefox/3.6.2

This vulnerability is similare to https://bugzilla.mozilla.org/show_bug.cgi?id=537862
[window.open] can load an URL adress and stop() its loading , 
and document.location can load an Authprompt of Evil.com on the URL adress stopped .

Reproducible: Always

Steps to Reproduce:
1.Use window.open('www.xxx.com')
2.Use Stop()
3.Use document.location on evil.com AuthPrompt
Actual Results:  
It's possible for a malicious page to convince a user to open a new tab or popup to a trusted service and then have the HTTP authorization prompt from the malicious page appear to be the login prompt for the trusted page.


Function JavaScript Used : 
window.open
window.stop
document.location

Comment 1

[Jordi Chancel]

Attachment: TESTCASE1

Comment 2

[Daniel Veditz [:dveditz]]

As in bug 537862 the auth prompt does say "A username and password are being requested by <site>" so it's not impossible for a user to detect the spoof (thus sg:low rather than something more severe), but it'd sure be nice if we could reformat that to highlight the site name instead of burying it in text.

I guess no text changes on the stable branches, but if we could make sure the location bar updates the site name that would help.

Comment 3

[Jordi Chancel]

Yes , when <window.open> is loading an URL adress , and after <document.location> is loading another URI scheme like <data:> / <http:> (...) , The location bar isn't directly update in some cases.

Comment 4

[Justin Dolske [:Dolske]]

Bug 537862 is unrelated to this.

Comment 5

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Is this the same as bug 529594?

Comment 6

[Doug Turner (:dougt)]

I can not reproduce any longer on ff-21.