[8] NetworkProcess setRawCookie IPC validation

Severity: High | Component: WebKit NetworkProcess | fb75cae

Rated High because the diff fixes two co-located issues: a compromised WebProcess could plant cookies for arbitrary registrable domains (session fixation, login-CSRF), and a malformed commentURL could crash NetworkProcess via an unhandled NSException.

NetworkConnectionToWebProcess::setRawCookie validated allowsFirstPartyForCookies but not the cookie's own domain field or the url parameter. A compromised renderer could plant a cookie for bank.com from a session anchored to evil.com.

Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp

     MESSAGE_CHECK(allowCookieAccess != NetworkProcess::AllowCookieAccess::Terminate);
+    MESSAGE_CHECK(RegistrableDomain::uncheckedCreateFromHost(cookie.domain).matches(firstParty));
+    MESSAGE_CHECK(RegistrableDomain(url).matches(firstParty));

Source/WebCore/platform/network/cocoa/NetworkStorageSessionCocoa.mm

+    BEGIN_BLOCK_OBJC_EXCEPTIONS
     auto nsCookies = createNSArray(cookies, [] (auto& cookie) -> NSHTTPCookie * {
         return cookie.createNSHTTPCookie().autorelease();
     });
-    BEGIN_BLOCK_OBJC_EXCEPTIONS
     [nsCookieStorage() setCookies:nsCookies.get() forURL:url.createNSURL().get() mainDocumentURL:mainDocumentURL.createNSURL().get()];
     END_BLOCK_OBJC_EXCEPTIONS

Patch Details

Two MESSAGE_CHECKs confirm cookie.domain and the url argument are within the same registrable domain as firstParty. The BEGIN_BLOCK_OBJC_EXCEPTIONS macro is widened so it now wraps the cookie.createNSHTTPCookie() conversion loop, where Foundation's initializer can raise NSException on malformed properties (e.g. commentURL).

Trusting WebProcess-supplied IPC arguments at a privileged-process trust boundary without cross-validating the security-relevant fields (cookie domain vs. firstParty) against the asserted origin.

Background

In WebKit's multi-process architecture, the WebProcess is sandboxed and untrusted from NetworkProcess's perspective; every IPC argument must be validated. RegistrableDomain represents an eTLD+1 computed via the Public Suffix List. cookie.domain is the Domain= attribute that the platform cookie store uses to decide which sites the cookie is sent to. BEGIN_BLOCK_OBJC_EXCEPTIONS installs @try/@catch around the enclosed block so a raised NSException does not propagate into C++ stack frames.

Analysis

The classic "NetworkProcess trusts WebProcess-supplied tuple" pattern: a (firstParty, url, cookie) triple with only one component validated and the other two riding free. The companion BEGIN_BLOCK_OBJC_EXCEPTIONS placement bug is a recurring footgun — the macro must wrap every Objective-C call that can throw, including conversion helpers in the same C++ function.

Two exploitation paths: (a) cookie injection assumes the attacker has WebProcess code execution; they craft a SetRawCookie IPC with attacker-origin firstParty and url and a cookie.domain set to a target like bank.com. The cookie store keys cookies by domain, so subsequent requests to bank.com carry it — session fixation, login-CSRF, persistent tracking. (b) NetworkProcess DoS via malformed commentURL aborts the process for every tab in the session.

This vulnerability weakens the cross-process trust boundary between sandboxed WebProcess and privileged NetworkProcess, and weakens the cookie origin model itself — a compromised renderer's blast radius extends to cookies for sites the user has never visited from that renderer.

Audit directions

NetworkProcess IPC handlers accepting (firstParty/origin/pageID, payload) tuples and validating only the authority field. Grep MESSAGE_CHECK(.*allowsFirstPartyForCookies and inspect the next 20 lines for a corresponding domain/origin cross-check on payload fields (cookie.domain, url's registrable domain, origin host).
BEGIN_BLOCK_OBJC_EXCEPTIONS scoping bugs. Grep Source/WebCore/platform/network/cocoa/ and Source/WebKit/*/cocoa/ for blocks where a sibling Objective-C call sits outside the protected region. Focus on cookie/credential conversion helpers.
Decode-time validation of WebCore::Cookie. Audit the deserializer in WebCoreArgumentCoders — does it validate domain, path, commentURL, expires at decode, or are all fields trusted strings?
RegistrableDomain::matches as the canonical cross-process origin check. Grep firstParty in Source/WebKit/NetworkProcess/ and flag handlers that take an additional URL parameter without a matching assertion.