HexBrain

Tor · Report #275960

Address Bar Spoofing on TOR Browser

Informativestatus
highseverity
14upvotes
2 Jan 2023disclosed

How it was found

Hi TOR team,

I would like to report a security bug in your browser:

Step 1: Goto http://www.ոokia.com/(http://jsbin.com/wuyikedaxi/1/edit?html,output) Step 2: Observe that address bar points to http://www.ոokia.com/ which actually to be pointing to http://xn--okia-zgf.com, however browser displays www.ոokia.com/

Actual results:

Address bar points to a spoofed domain http://www.ոokia.com/. Address bar fails to parse character "ո"(U+0578 Armenian Small Letter). Several other characters from Armenian family lead to the same effect.

Expected results:

TORbrowser should have resolved the domain to real http://xn--okia-zgf.com. On chrome, internet explorer and firefox it resolves to xn--okia-zgf.com.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original