Bug: phishing link via obfuscated dummy basic auth url link with obfuscated attacker link
Status: RESOLVED
Priority: --
Resolution: DUPLICATE
Created: 2022-04-05 21:01:55+00:00
Resolved: 2022-04-11 04:48:47+00:00

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36

Steps to reproduce:

Platform:

 firefox Version 94.0.2 (64-bit) older versions are affected NOT ALL WERE TESTED

Class:

Security Feature Bypass

Bounty Program:

 firefox Bounty Program

Summary:

Basic authentication obfuscation and adding a domain in username or password field would result in a successful link that looks like the real website links

Description:

firefox allows basic auth in his address bar , a normal basic auth would like like this :

"https://user:password@domain.com/path/file"

A basic auth request can also not contain the password part or the user part.

like this:

"https://:password@domain.com/path/file"

"https://user@domain.com/path/file"

if we look at both option instead of user and password let's put a trusted domain like microsoft.com

"https://:microsoft.com@domain.com/path/file"

"https://microsoft.com@domain.com/path/file"

now let's put facebook.com as our malicious domain.

"https://:microsoft.com@facebook.com"

"https://microsoft.com@facebook.com"

now let's encode facebook.com in utf-8 or use ip address in decimal view :

"https://:microsoft.com@%66%61%63%65%62%6F%6F%6B%2E%63%6F%6D"

"https://microsoft.com@%66%61%63%65%62%6F%6F%6B%2E%63%6F%6D"

"https://:microsoft.com@520966948"

"https://microsoft.com@520966948"

now let's put "  ∕  " which looks just like " /  " but allowed in username field and put some path and add = sign before the "@" sign

"https://microsoft.com∕jibrish∕something=@%66%61%63%65%62%6F%6F%6B%2E%63%6F%6D"

"https://:microsoft.com∕jibrish∕something=@%66%61%63%65%62%6F%6F%6B%2E%63%6F%6D"

"https://:microsoft.com∕jibrish∕something=@520966948"

"https://microsoft.com∕jibrish∕something=@520966948"

and that's it a malicious link that looks like a normal link.

Perhaps from a fix perspective you could look for :

1)restrict access to the following cases a username with special characters for basic AUTH , a domain/IP address  in the username or password field of basic AUTH ,

you only warn on this case  a website that doesn't use basic auth is warned when clicked.



Proof of Concept:

I’ve provided a PoC which will demonstrate the bypass. Ensure you use the correct version for the firefox software on Windows, the bug would probably work on more versions and even older firefox pre46 wasn't tested

 Follow these steps:

1) Open firefox browser

2) enter this address in the address bar :

"https://microsoft.com∕jibrish∕something=@%66%61%63%65%62%6F%6F%6B%2E%63%6F%6D"

3)click enter

4)  as you can see you are transferred to facebook.com

additional links:

"https://microsoft.com∕jibrish∕something=@%66%61%63%65%62%6F%6F%6B%2E%63%6F%6D"

"https://:microsoft.com∕jibrish∕something=@%66%61%63%65%62%6F%6F%6B%2E%63%6F%6D"

"https://:microsoft.com∕jibrish∕something=@520966948"

"https://microsoft.com∕jibrish∕something=@520966948"

Expected Result:

it shouldn't pass me to the website

Observed Result:

the user is transferred to the attacker's website



Potential damages:

1)Bad reputation to  firefox

2)Potential sue from customers

3)Hundreds of millions of dollars which will be lost due to successful phishing attack



Usage:

1)Phishing attacks. (I would use SMS  or emails)

As this is a zero day and affects most browsers please do not publish that until received permission from me, as other vendors might be in trouble if you fix it before them.

Also after the fixing is done I would like to open a CVE  on the issue. (Your help will be appreciated)



My contact info :

roybarkayyosef@gmail.com

phone or whatsup : +972 544605550

linkedin : https://il.linkedin.com/in/roy-barkay-a98aa2166