1005674 - The Flash video player allows cross-site includes due to a missing source check

Status: RESOLVED FIXED

(www.mozilla.org :: General, defect)

Description

[schuenjia]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:29.0) Gecko/20100101 Firefox/29.0 (Beta/Release)
Build ID: 20140421221237

Steps to reproduce:

- Click on http://www.mozilla.org/media/flash/playerWithControls.swf?flv=http://www.attacker.site
- check that a request is sent to the predefined site in background


Actual results:

A request is sent to an attacker's site w/o being noticed by a user.
An attacker can prepare flv or mp4 files for malicious uses.
Furthermore, XSS should also be checked in this case.


Expected results:

- use whitelist
- do not allow loading external resource

Comment 1

[Kohei]

See also Bug 439560.

Comment 2

[Kohei]

Attachment: pull request

So the fix in Bug 439560 was lost at some point. I sent a pull request to implement a similar mitigation.

Comment 3

[[github robot]]

Commits pushed to master at https://github.com/mozilla/bedrock

https://github.com/mozilla/bedrock/commit/74db552da5fe52685f0410a5e596d7ae622bf657
Fix Bug 1005674 - The Flash video player allows cross-site includes due to a missing source check

https://github.com/mozilla/bedrock/commit/781b67087018943003058d6bcac3ed69c07a834c
Merge pull request #1968 from kyoshino/bug-1005674-flash-player-csrf

Fix Bug 1005674 - The Flash video player allows cross-site includes due to a missing source check

Comment 6

[[github robot]]

Commit pushed to master at https://github.com/mozilla/bedrock

https://github.com/mozilla/bedrock/commit/16496732d75a5b6d21afdcc57c5b217b480dd220
Move flash video player blocking to app.

For bug 1005674. This was done in apache, and now
it's in our Whitenoise subclass.