Bug: Firefox Browser - Download Site Obscured from User
Status: VERIFIED
Priority: P1
Resolution: FIXED
Created: 2020-05-28 08:53:09+00:00
Resolved: 2024-05-30 17:14:55+00:00

University of Birmingham Vulnerability Report - Firefox Browser - Download Site Obscured from User

About this Document
-------------------
This document details a vulnerability identified by the University of Birmingham in the Firefox Web Browser.

University of Birmingham Contact Information
--------------------------------------------
The researchers, Richard Thomas and Tom Chothia can be contacted at {r.j.thomas,t.p.chothia}@cs.bham.ac.uk. Please contact us for our PGP key.

Crediting the University of Birmingham
--------------------------------------
The University of Birmingham would appreciate credit to the researchers and the University for any advisories which you may publish about this issue.

Please inform the researchers via their contact email addresses should you:
- confirm that this is a security issue
- allocate the issue a CVE identifier
- determine a date to release a patch
- determine a date to publish advisories

University of Birmingham Disclosure Policy
------------------------------------------
The University of Birmingham follows a responsible, coordinated disclosure approach with affected parties. We do not publicly disclose vulnerabilities without consulting the vendor.

The University of Birmingham recognises that vendors need a reasonable amount of time to mitigate a vulnerability, understand the impact to customers, triage other vulnerability reports and implement resolutions in coordination with others and its customers. The researchers are happy to discuss how such disclosures may take place.

If the researchers believe a vendor is not making appropriate progress with the resolution of this vulnerability, we may, following discussion with the vendor, choose to share details with the UK National Cyber Security Centre to protect UK interests.

Summary
-------
A User Interface (UI) Misrepresentation of Critical Information issue exists on the Download UI process on the Firefox browser, and has been tested on Firefox 76.0.1 for Windows, MacOS and Linux (Kali Repositories). This can be exploited by an adversary exploiting an Open Redirect (CWE-601) on a trusted device to display the source of the download in the Download List UI as the trusted device, and not the true download site. 

If a user is tricked into downloading and running a malicious file by making the trusted host appear in the downloads list, they will be more likely to run the malware.

These vulnerabilities have a Severity Score of 7.1 and a High Severity rating (based on the Common Vulnerability Scoring System v3.1).

CVSS
----
This vulnerability has a Severity Score of 7.1 and a High Severity rating (the CVSS Vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
The Common Weakness Enumeration ID is CWE-451: User Interface (UI) Misrepresentation of Critical Information.

Details
-------
The Firefox browser is one of a number of cross-platform browsers which commonly used by end-users. Where an Open Redirect vulnerability (CWE-601) exists on a device that is trusted by the user, the response to a user request may redirect the user to untrusted content which was not initially requested. In Firefox, given an Open Redirect using the HTTP POST method, upon receipt of the HTTP 302 Redirect from the trusted device, the browser may start a download of a malicious file from the adversary. Where Firefox displays a dialog box for the user to select whether to Open or Save the file, the adversary host is displayed as the source, however, upon completion of the download, the Download UI on Firefox displays the trusted device as the source of the download in the list. Where the user has previously configured Firefox to automatically save files of a particular type, the user would see the trusted device as the download host, not the adversary's host.

On MacOS, if the user attempts to execute an installer downloaded via the Open Redirect, MacOS Gatekeeper will confirm that Firefox downloaded the file from the trusted device, and not the true download site.

This issue has been tested on Firefox 76.0.1. on Windows 10 Enterprise N (Version 1709), MacOS 10.15 Catalina and Kali Linux 2019.4. 

Steps to reproduce:
- Submit a HTTP POST request to a trusted device, which will issue a HTTP 302 Redirect to another site, hosting a download.
- If a download prompt is displayed, the site should be shown as the one indicated in the 302 Redirect. Click Save.
- Once the download has completed, click the Download UI Button, and the file should show there. No host is displayed. Click 'Show All Downloads' and the downloaded file will show in the list with the host shown as the trusted device, not the true download site.

PoC code is given at the bottom of this report.

Mitigation
----------
Firefox should display the name of the host that the file was downloaded from in teh download list (i.e. the host stated in the download dialog), not the name of the host that issued the redirect.

Note
----
This issue was identified during the assessment of an Open Redirect Vulnerability using POST, which is undergoing responsible disclosure with the Vendor. 

A minimal example demonstrating this behaviour is given below:

1. Trusted Page simulating Open Redirect form behaviour (test.html)
<!DOCTYPE html>
<html>
<body>
<form action="index.php" method="POST">
  <input type="submit" value="Submit">
</form> 

<p>If you click the "Submit" button, the form-data will be sent to a page called "/index.php".</p>

</body>
</html>

2. PHP (on server) to trigger the download and force this behaviour
<?php
Header("HTTP/1.1 302 Object Moved" );
Header("Content-Type: text/html; charset=UTF-8");
Header("Cache-Control: no-cache");
Header("Pragma: no-cache");
Header("Expires: 0");
Header("Location: //<Download Page>");
Header("Content-Length: 0");
Header("Connection: close");
exit();
?>