October 11, 2012

Firefox is leaking URLs data across domain, by not restricting javascript’s “location” method.  How does it work?

A “proof of concept” exploit for the vulnerability exists (for more, check this out).

  1. A user browses to the attacker site.
  2. That attacker opens a new window in Twitter from attacker site.
  3. If the victim is signed in to twitter, then the user gets redirected to a URL that contains a personal twitter ID.
  4. The attacker can now query the new window on the URL and obtain the victim’s personal twitter ID.

On previous versions of Firefox, this attack would fail:

FF1

There was a regression in Firefox 16 that allowed this attack to work:

FF2

 

 

 

Share:
Share on LinkedIn

Posted by Imperva Blogger at 07:34:57 AM


Tags:

Comments

Verify your Comment

Previewing your Comment

This is only a preview. Your comment has not yet been posted.

Working...
Your comment could not be posted. Error type:
Your comment has been saved. Comments are moderated and will not appear until approved by the author. Post another comment

The letters and numbers you entered did not match the image. Please try again.

As a final step before posting your comment, enter the letters and numbers you see in the image below. This prevents automated programs from posting comments.

Having trouble reading this image? View an alternate.

Working...

Post a comment

Comments are moderated, and will not appear until the author has approved them.