17-Year-Old Weakness in Firefox Let HTML File Steal Other Files From the Device

Barak Tawily, an application security researcher, shared his
findings^[1] with The Hacker News,
wherein he successfully developed a new proof-of-concept attack
against the latest version of Firefox by leveraging a 17-year-old
known issue^[2] in the browser.

The attack takes advantage of the way Firefox implements Same Origin
Policy (SOP) for the “file://” scheme URI (Uniform Resource
Identifiers), which allows any file in a folder on a system to get
access to files in the same folder and subfolders.
^[3]

Since the Same Origin Policy for the file scheme has not been
defined clearly in the RFC by IETF, every browser and software have
implemented it differently—some treating all files in a folder as
the same origin whereas other treat each file as a different
origin.

Tawily told The Hacker News that Firefox is the only major
browser that didn’t change its insecure implementation of Same
Origin Policy (SOP) for File URI Scheme over time and also supports
Fetch API over file protocol.

Demo: Firefox Local Files Theft (Unpatched)

Though the implementation weakness in Firefox has already been
discussed on the Internet over and over again in previous years,
this is the first time when someone has come up with a complete PoC
attack that puts security and privacy of millions of Firefox users
at risk. As shown in the video demonstration, Tawily exploited this
old-known issue in combination with a clickjacking attack and a
“context switching” bug that allowed his exploit code to
automatically:

• get the list of all files located in the same folder and
  subfolders where the malicious HTML has been downloaded by the
  browser or saved by the victim manually,
• read the content of any specific or all files using Fetch API,
  and then
• send collected data to a remote server via HTTP requests.

For a successful execution of this attack, attackers are required
to trick victims into downloading and opening a malicious HTML file
on the Firefox web browser and click on a fake button to trigger
the exploit.

Tawily told The Hacker News that all the above-mentioned actions
could secretly happen in the background within seconds without the
knowledge of victims, as soon as they click the button place
carefully on the malicious HTML page.

It should be noted that this technique only allows the malicious
HTML file to access other files in the same folder and its
subfolders.

In his PoC attack scenario, Tawily shows how an attacker can
easily steal secret SSH keys of Linux victims if a user saves
downloaded files in the user-directory, which also contains SSH
keys in its subfolder.

Firefox is not going to patch it anytime soon

The researcher responsibly reported his new findings to Mozilla,
who responded by saying
“Our implementation of the Same Origin Policy allows every file://
URL to get access to files in the same folder and subfolders.”

This suggests that the company currently seems to have no plans
to fix this issue in its browser anytime soon.

While talking about an alternative approach to fix this issue,
Twaily said, “Security-wise I think this should be addressed in RFC
side, that should enforce user-agents (browsers) to implement the
most secure approach, and don’t allow developers make such mistakes
that leave the client exposed to such attacks.”

In 2015, researchers discovered a similar, but remotely
executable, vulnerability in
the same-origin^[5]
policy for FireFox that attackers exploited in the wild to steal
files stored on Firefox users’ computers when they clicked
malicious ads on websites.

Though the newly demonstrated attack requires a little more of
social engineering, many Firefox users can still easily fall victim
to this as well.

^[4]