Bug: FireFox Same Site "Strict" Cookie Bypass via firefox/firefox-private protocol/schemes registered with the OS and using an external browser
Status: RESOLVED
Priority: --
Resolution: FIXED
Created: 2024-01-05 15:43:33+00:00
Resolved: 2024-09-16 07:17:18+00:00

Dear Team,

Here are the vulnerability details.

Description
SameSite is an attribute that can be set for cookies in web browsers. It is used to control how cookies are sent with cross-site requests. The SameSite attribute helps mitigate the risk of cross-site request forgery (CSRF) attacks and protects user privacy.

There are three possible values for the SameSite attribute:

1. Strict: When a cookie has the `SameSite=Strict` attribute, it will only be sent in a first-party context. This means that the cookie will only be sent if the request originates from the same site as the one that set the cookie.

    Example:
    ```plaintext
    Set-Cookie: mycookie=myvalue; SameSite=Strict;
    ```

2. Lax:With `SameSite=Lax`, cookies are allowed to be sent with top-level navigations and safe HTTP methods (like GET), but they will not be sent when the request is initiated by a third-party website through methods such as a cross-origin POST request.

    Example:
    ```plaintext
    Set-Cookie: mycookie=myvalue; SameSite=Lax;
    ```

3. None: Setting `SameSite=None` allows cookies to be sent with both first-party and third-party requests. This is often used for scenarios where the cookie needs to be sent across different domains, such as when embedding content from one site into another.

    Example:
    ```plaintext
    Set-Cookie: mycookie=myvalue; SameSite=None; Secure;
    ```

Uses of Same Site Cookies
CSRF Protection: CSRF attacks involve an attacker tricking a user's browser into making an unintended request to a different site where the user is authenticated. If cookies are sent automatically with every request, the attacker could exploit this to perform unauthorized actions on behalf of the user. SameSite helps mitigate this risk by preventing cookies from being sent in certain cross-site scenarios.

What is Browser Fails to Protect Same Site Cookies
If a browser fails to properly enforce the SameSite=Strict attribute for cookies, it can have security implications, particularly in the context of cross-site request forgery (CSRF) attacks. Here are the potential impacts:

1. CSRF Vulnerability: The primary purpose of SameSite=Strict is to protect against CSRF attacks by preventing cookies from being sent in cross-site requests. If a browser fails to enforce this attribute, it could expose users to CSRF vulnerabilities. An attacker might be able to initiate unauthorized actions on behalf of a user if their cookies are automatically included in requests to a different site.
Ex. Daps Website/Program run inside firefox website, might have using SameSite cookie protection (now days most of them are doing it for CSRF protection) Now developer will think that because they have used SameSite Strict cookies, they are safe from CSRF attacks but because of this bypass they are still vulnerable.

2. Unauthorized Actions: CSRF attacks typically involve tricking a user's browser into performing actions on a target site without the user's consent. If SameSite=Strict is not enforced, an attacker could potentially perform actions, such as changing the user's account settings, making financial transactions, or performing any action that the user is authorized to do on the target site.

3. Cross-Site Tracking: SameSite=Strict also enhances privacy by preventing automatic cookie inclusion in cross-site requests. If this protection is not in place, third-party sites may have increased visibility into users' activities across different domains, leading to potential tracking and profiling.

4. Reduced Security by Design: SameSite=Strict is designed to be a security measure by default. If a browser fails to enforce it, the security posture of the web becomes weakened, as developers may rely on this protection when building and securing web applications.

Tested On
Windows 11 Pro
FireFox Window Version 121.0

The POC
Video https://drive.google.com/file/d/12SSLaTQHiNWHYt-53zC3yPO3_NjGLrg7/view?usp=sharing
POC Exploit Codes - Readily available below
https://g00gle.in/samefirefox/ss.php
https://g00gle.in/samefirefox/ss.html
https://g00gle.in/samefirefox/attacker.html

1.Browse https://g00gle.in/samefirefox/ss.php and First click on **1) FirstSet Same Site Cookie** Button which will create the same site strict cookie name as SecretCookie and its value as IUHUIGIGAIIGIGUIGSUIGIGIGSIGUIGUIFFTFDTRFYVUVBHJBHJ for website https://com.egghunter.in
2. Go back and now click on **2 ) Verify Same Site Cookie Are Se** now because the cookies are set as **Strict** you won't find them request to https://com.egghunter.in this is how FireFox browser is protecting user from CSRF Attacks because g00gle.in is cross domain which is requesting to "com.egghunter.in" both are cross domain so Strict Cookie won't be pass.
3. Now from Google Chrome browse this https://g00gle.in/samefirefox/attacker.html , there will be button to "Open In FireFox" open it and click on Open in prompt.
4. It will redirect from chrome to firefox with URL pointing to https://com.egghunter.in/showcookie.php but this time the SameSite cookies are sent to that server, which shows we bypass the SameSite cookie protection of firefox browser.

Suggestion
Do not send the same site a strict cookie via deeplink.

CVSS Score

1. **Attack Vector (AV): Network (N)**
   - **Reason:** The  attack is conducted remotely, targeting the network. This aligns with the scenario where a browser fails to protect SameSite=Strict cookies, and an attacker can exploit the vulnerability remotely.

2. **Attack Complexity (AC): Low (L)**
   - **Reason:** Exploiting the failure in SameSite=Strict is not particularly complex and can be achieved with relatively low effort.

3. **Privileges Required (PR): None (N)**
   - **Reason:** The assumption is that the attacker does not require any specific privileges to exploit the vulnerability. The attack can be carried out with minimal access.

4. **User Interaction (UI): Required (R)**
   - **Reason:** Victim needs to interact with attacker URL.

5. **Confidentiality (C): High (H)**
   - **Reason:** The  failure to protect SameSite=Strict cookies can lead to a high impact on confidentiality, potentially exposing sensitive information (cookies).

6. **Integrity (I): High (H)**
   - **Reason:** The integrity of the system is highly impacted by the vulnerability, as the attacker can  tamper with data or perform unauthorized actions using CSRF attack which is most important part of introducing same site cookies.

7. **Availability (A): Low (L)**
   - **Reason:** The assumption is that while the vulnerability has an impact on availability, it is not as severe as the impacts on confidentiality and integrity. The focus is on data manipulation rather than denial of service.

Impact

1. CSRF Vulnerability: The primary purpose of SameSite=Strict is to protect against CSRF attacks by preventing cookies from being sent in cross-site requests. If a browser fails to enforce this attribute, it could expose users to CSRF vulnerabilities. An attacker might be able to initiate unauthorized actions on behalf of a user if their cookies are automatically included in requests to a different site.

2. Unauthorized Actions: CSRF attacks typically involve tricking a user's browser into performing actions on a target site without the user's consent. If SameSite=Strict is not enforced, an attacker could potentially perform actions, such as changing the user's account settings, making financial transactions, or performing any action that the user is authorized to do on the target site.

3. Cross-Site Tracking: SameSite=Strict also enhances privacy by preventing automatic cookie inclusion in cross-site requests. If this protection is not in place, third-party sites may have increased visibility into users' activities across different domains, leading to potential tracking and profiling.

4. Reduced Security by Design: SameSite=Strict is designed to be a security measure by default. If a browser fails to enforce it, the security posture of the web becomes weakened, as developers may rely on this protection when building and securing web applications.