940085 - It's possible to call some methods on a cross-origin window by using bug 936056

Status: RESOLVED FIXED

(Core :: Security, defect)

Description

[moz_bug_r_a4]

Bug 936056 allows script to get the inner window, and it's possible to call some methods on a cross-origin window by using the inner window.

This bug is similar to bug 938640, which affects fx27,28, but this bug affects fx24-28.

Comment 1

[moz_bug_r_a4]

Attachment: testcase 1 - getSelection

Comment 2

[moz_bug_r_a4]

Attachment: testcase 2 - fake password popup

Comment 3

[Boris Zbarsky [:bzbarsky]]

Yeah, this is the same exact thing in bug 938640 except there we manage to invoke these on an inner that's not same-origin with its outer via WebIDL the global computation in WebIDL methods and here we just do it more directly.

I would think that the same fix as for bug 938640, appropriately backported, would help here.

Comment 4

[Bobby Holley (:bholley)]

Boris explained to me on IRC that this generalizes the attack from bug 938640 so that it's no longer just a regression from webidl quickstubs, but affects anything that bug 936056 affects, because it uses the JIT, rather than bareword references, to operate on a non-current inner.

Comment 5

[Andrew McCreight [:mccr8]]

Peter is looking at bug 938640, and comment 3 says the fix for this will be the same or at least similar, so I'm going to set him as assigned here.

Comment 6

[Andrew McCreight [:mccr8]]

Is this fixed now, Peter?

Comment 7

[Andrew McCreight [:mccr8]]

Is this fixed by bug 938640, moz_bug_r_a4?  Thanks.

Comment 8

[moz_bug_r_a4]

(In reply to Andrew McCreight [:mccr8] from comment #7)
> Is this fixed by bug 938640, moz_bug_r_a4?  Thanks.

This is fixed by bug 938640 on fx >= 27, but this is fixed by bug 936056 on esr24.

Comment 9

[u279076]

Nominating in-testsuite given this has testcases.