Filed under #security#bug-bounty

Address bar spoofing in Firefox Lite for Android ...and the idiocy that followed

2 min read

First published on my old blog, Tinkering the kernel, in 2020.

Firefox Lite 1.9.2 for Android and earlier suffer from Address Bar Spoofing, allowing attackers to potentially trick a victim into visiting a malicious domain.

Date reported — 2019-08-29

Summary

Firefox Lite 1.9.2 for Android and earlier suffer from exhaustive Address Bar Spoofing, allowing attackers to potentially trick a victim into visiting a malicious domain under a legitimate domain name. Firefox Lite is installed on more than 10M devices.

Impact

URL Address Bar spoofing is the worst kind of phishing attack possible because, for a non-technical user, the address bar is the only way to identify the site they're visiting. It's the only way to trust a website and if this indicator is hijacked, the whole security of any normal user is compromised.

Explanation

The address bar can be spoofed by a crafted JavaScript page with a setInterval() function which executes a pwn() function which ultimately reloads the target URL every 10ms.

Proof of concept (POC)

  1. Opening Firefox Lite; Latest version i.e. 1.9.1 (13361)
  2. Spawning a HTTP web-server with the attached payload i.e. spoof.html
  3. Loading the page e.g http://10.10.10.10/spoof.html
  4. URL gets spoofed and shows contents of spoof.html while URL points at https://www.mozilla.org/en-US/

Expected behavior

The browser should successfully redirect to the target website.

Reply from Mozilla

Quickly acknowledging, validating, and resolving submitted issues while recognizing the researcher's effort is vital for successful vulnerability coordination, but the report didn't get any attention after the initial triage and half-hearted discussion.

…11 months later

I got fed up after waiting for months, eleven months to be exact. I emailed security@mozilla.org asking them to look at the stale bug report.

Piyush Raj (0x48piraj) to Mozilla Security

Frederik helped to re-initiate the stalled report. This is what happened afterwards —

Sitting on the report for 11 months while Google's webview versions were regularly updated then establishing low impact is scummy behaviour.

I don't think the reply needs any more explanation. I leave it up to you to judge the response. I'm not gonna do anything now. Let's see what happens.

Peace out.