Closed
Bug 952010
Opened 12 years ago
Closed 6 years ago
Let press the ENTER key more than one second can download/execute file and this can lead by a spoofing attack.
Categories
(Firefox :: File Handling, defect)
Tracking
()
RESOLVED
FIXED
Firefox 69
| Tracking | Status | |
|---|---|---|
| firefox-esr68 | --- | fixed |
People
(Reporter: jordi.chancel, Assigned: Gijs)
References
Details
(Keywords: csectype-spoof, reporter-external, sec-low, Whiteboard: [reporter-external])
Attachments
(2 files)
User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:27.0) Gecko/20100101 Firefox/27.0 (Beta/Release)
Build ID: 20131209204824
Steps to reproduce:
- On all Version Of Firefox ( stable / nightly / Beta / aurora ) it's possible to make a spoofing attack (like bug 916726) but with a different way.
- On Firefox Stable, let press ENTER KEY Leads directly at execute file.
- On Firefox Nightly, let press ENTER KEY more than one second leads to the same result.
- With a DMG file that contains a PKG file it's possible to make a Spoofing Attack.
Actual results:
- On Firefox Nightly, Press ENTER more than One Second leads to execute file and this leads to spoofing attacks.
- On Firefox Stable, Press ENTER Leads directly at execute a file and this leads to the same result.
Expected results:
- Press ENTER is a bad Way for security Reasons.
- This can lead to spoofing attacks.
|
Reporter | |
Comment 1•12 years ago
|
||
Video of vulnerability on Firefox Stable/Beta.
|
|
Reporter | |
Comment 2•12 years ago
|
||
<body onkeydown="keydetect(event)">
<h1>PRESS ENTER 2 seconds please</h1>
<script>
function keyactive(keynb){
if(keynb==13){document.location='./test.php';}
}
function keydetect(e){
if(parseInt(navigator.appVersion,10) >=4){
if(navigator.appName == 'Netscape'){
mykey = e.which;
keyactive(mykey);
}
else{
mykey = e.keyCode;
keyactive(mykey);
}
}
}
</script>
</body>
This is a social engineering attack that is inducing a user to press a key for a given amount of time in order to have key-presses passed to subsequent windows that then take action. As such this is being rated as sec-moderate as bug 916726 has been. This may be considered a duplicate of that bug on further review.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Flags: sec-bounty?
Keywords: sec-moderate
Whiteboard: [reporter-external]
|
||
Updated•12 years ago
|
Attachment #8349952 -
Attachment mime type: application/zip → application/java-archive
|
|
||
Comment 4•12 years ago
|
||
This is silly, effectively re-opening bug 916726 with the complaint that our timeout should be longer which does not rate a second bounty. We could make it longer but would that really help? At some point if you find a victim that will do what you tell them to do there's nothing a browser can do to help that person.
Flags: sec-bounty? → sec-bounty+
|
|
||
Updated•12 years ago
|
Flags: sec-bounty+ → sec-bounty-
|
||
Comment 5•12 years ago
|
||
Sounds like WONTFIX to me. If you keep holding "enter" after the new dialog pops up, not much we can do.
Component: Untriaged → File Handling
|
||
Updated•10 years ago
|
Group: core-security → firefox-core-security
|
||
Comment 7•6 years ago
|
||
Gijs, as triage owner, do you want to keep this open or is it a wontfix?
Flags: needinfo?(gijskruitbosch+bugs)
|
Assignee | |
Comment 8•6 years ago
|
||
I believe this was fixed in bug 1552627. If you're key-repeating before the dialog comes up, we will not enable the button as long as the key stays down.
Status: NEW → RESOLVED
Closed: 6 years ago
Flags: needinfo?(gijskruitbosch+bugs)
Resolution: --- → DUPLICATE
|
|
Assignee | |
Comment 9•6 years ago
|
||
Probably more accurate to have as a dep rather than a dupe.
Assignee: nobody → gijskruitbosch+bugs
status-firefox-esr68:
--- → fixed
Depends on: CVE-2019-11702
OS: macOS → All
Hardware: x86 → All
Resolution: DUPLICATE → FIXED
Target Milestone: --- → Firefox 69
|
||
Updated•6 years ago
|
Group: firefox-core-security → core-security-release
|
|
||
Updated•5 years ago
|
Group: core-security-release
|
|
||
Updated•3 years ago
|
See Also: → CVE-2024-11697
|
||
Updated•2 years ago
|
Keywords: reporter-external
You need to log in
before you can comment on or make changes to this bug.
Description
•