In Firefox for Android serious in the implementation of the protocol , used for discovering network services on the local network. The vulnerability allows an attacker on the same local or wireless network to respond to Firefox's probing requests with a UPnP XML "LOCATION" message containing , which can be used to open an arbitrary URI in the browser or invoke handlers of other applications.
The issue is present up to the release of and is addressed in Firefox for Android version 79, meaning older classic releases of Firefox for Android are vulnerable and require upgrading to of the browser (Fenix), which uses the GeckoView engine built on Firefox Quantum technologies and a set of libraries. The issue does not affect desktop versions of Firefox.
To test the vulnerability a working prototype of the exploit. The attack is carried out without any action from the user; it is sufficient for a vulnerable Firefox for Android browser to be running on the mobile device and for the victim to be on the same subnet as the attacker's SSDP server.
Firefox for Android periodically sends SSDP messages in broadcast mode (multicast UDP) to detect broadcasting devices present on the local network, such as multimedia players and smart TVs. All devices on the local network receive these messages and can respond. Normally, the device returns a link to the XML file with information about the device that supports UPnP. During an attack, instead of a link to the XML, a URI with intent commands for Android can be sent.
With intent commands, users can be redirected to phishing sites or provided with a link to an xpi file (the browser will prompt to install the extension). Since the attacker's responses are unrestricted, they may attempt to overwhelm the browser with installation prompts or malicious websites in the hope that the user mistakenly clicks to install the malicious package. In addition to opening arbitrary links in the browser, intent commands can also be used to process content in other Android applications, such as opening an email template in the email client (URI mailto:) or launching the interface to make a call (URI tel:).
Source: opennet.ru
