PatchGap
Firefox · Toolkit

CVE-2024-11696

Logic Error in Toolkit
Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionThe application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated add-ons may have been bypassed. Signature validation in this context is used to ensure that third-party applications on the user's computer have not tampered with the user's extensions, limiting the impact of this issue.
ComponentToolkit
Bug ClassLogic Error
Tracker1929600
Fix commit14b51a4cdc84 (firefox) +16/-6
CISA KEVNot listed
CreditedRob Wu
Disclosed2024-11-26

Files Changed

  • toolkit/mozapps/extensions/internal/XPIDatabase.sys.mjs

Patch

view commit
diff --git a/toolkit/mozapps/extensions/internal/XPIDatabase.sys.mjs b/toolkit/mozapps/extensions/internal/XPIDatabase.sys.mjs
index 17219a88b42..b277e418618 100644
--- a/toolkit/mozapps/extensions/internal/XPIDatabase.sys.mjs
+++ b/toolkit/mozapps/extensions/internal/XPIDatabase.sys.mjs
@@ -2228,12 +2228,22 @@ export const XPIDatabase = {
           addon.signedState === lazy.AddonManager.SIGNEDSTATE_SIGNED &&
           Services.policies
         ) {
-          const addonDetailsFromFile =
-            await XPIExports.XPIInstall.loadManifestFromFile(
-              addon._sourceBundle,
-              addon.location
-            );
-          addon.adminInstallOnly = addonDetailsFromFile.adminInstallOnly;
+          // Manifest file for an installed extension can still become
+          // invalid (e.g. due to backward incompatible changes between
+          // Firefox versions).
+          try {
+            const addonDetailsFromFile =
+              await XPIExports.XPIInstall.loadManifestFromFile(
+                addon._sourceBundle,
+                addon.location
+              );
+            addon.adminInstallOnly = addonDetailsFromFile.adminInstallOnly;
+          } catch (err) {
+            // Simply log the error as a warning to be able to check
+            // the signature and potentially update the disabled state
+            // accordingly.
+            logger.warn(`XPI_verifySignature Warning on '${addon.id}': ${err}`);
+          }
         }
 
         if (
Loading diff…
On This Page