Security vulnerabilities in web browsers can allow attackers to trick users or steal information. One such vulnerability, CVE-2023-23601, affected Mozilla Firefox (before version 109), Thunderbird (before 102.7), and Firefox ESR (before 102.7). This flaw allowed website spoofing attacks by mishandling how browsers navigate when a user drags a URL from a cross-origin iframe into the same tab. Let’s dive into what happened, how it worked, and see a practical example.

What is CVE-2023-23601?

CVE-2023-23601 is all about drag-and-drop navigation combined with browser iframe behaviors. Essentially, if a website loaded some content from another domain in an <iframe>, and you dragged a link or URL from inside that frame into the main browser window (or tab), Firefox and Thunderbird would let the navigation happen -- even though it shouldn’t have.

This broke the browser’s same-origin policy, a critical security rule that’s supposed to keep different websites from interfering with each other. An attacker could use this flaw to mask their phishing site as a trusted one by tricking the browser into showing the wrong URL (website address) in the bar.

TL;DR:

Malicious websites could make their fake page look like it belonged to a trusted site, making it much easier to steal your passwords or personal info.

Thunderbird versions before 102.7

If you use any of these, update your browser right now!

Attackers could exploit this in three simple steps

1. Load a malicious (evil.com) page with a cross-origin iframe showing the legit target site (like paypal.com).
2. Drag a URL from inside the iframe (for example, a link or location bar) into the main browser window or tab.
3. Browser navigates to the dragged URL _in the same tab_, but the attacker can control the page contents. Because of the drag-and-drop, the browser address bar may display the real target’s URL (paypal.com), but the attacker’s fake content is actually being displayed.

This tricks users into thinking they’re safely on a trusted site, when in reality, they’re not.

Let’s look at a simplified version of a proof-of-concept (PoC)

<!DOCTYPE html>
<html>
  <body>
    <h1>Malicious Page</h1>
    <iframe src="https://trusted-site.com"; width="500" height="300" id="victimFrame"></iframe>
    <p>
      <b>Drag the URL from inside the embedded iframe and drop it here!</b>
    </p>
    <div id="dropArea" style="width:100%;height:100px;border:2px dashed red;">
      Drop Here
    </div>
    <script>
      // Listen for drop event
      document.getElementById('dropArea').addEventListener('drop', function(e) {
        // The attack happens during the user's drag-n-drop action
        alert('If browser navigates or replaces contents, it is vulnerable!');
      });
    </script>
  </body>
</html>

The iframe shows the real trusted site (like paypal.com).

- The attacker encourages users to drag a link or even the location bar URL from the iframe to the drop area.
- If the user does it, the browser navigates, but the content doesn’t match the address bar. This is the basis of the spoof.

In vulnerable Firefox/Thunderbird versions, the browser allows this to occur, opening the door for phishing.

Technical Details (Under the Hood)

Firefox failed to strictly limit drag-and-drop from a cross-origin iframe into the same tab. Drag events from an iframe hosted on another origin should not trigger navigation in a parent context, but this check was improperly handled.

Here’s what should happen (simplified logic)

function onDrop(event) {
  if(isCrossOrigin(event.source, window)) {
    // Block navigation
    event.preventDefault();
    alert("Attempt to navigate from cross-origin iframe is blocked.");
  }
}

But versions before the fix allowed the drop, causing the navigation.

Official References

- Mozilla Security Advisory 2023-04
- NIST NVD Entry for CVE-2023-23601

Conclusion

CVE-2023-23601 is a great example of a web security weakness that may sound minor but can have major consequences. Always keep your browser up to date, and think twice when a website asks you to interact with it in unusual ways. For browser developers, it’s a reminder that even small UI/UX features like drag-and-drop can become attack vectors.

Timeline

Published on: 06/02/2023 17:15:00 UTC
Last modified on: 06/08/2023 18:55:00 UTC