1976304 - (CVE-2025-55030) Firefox iOS Ignores Content-Disposition Header allows XSS

Status: VERIFIED FIXED

(Firefox for iOS :: General, defect)

Description

[Renwa]

Attachment: firefox-ios-download-render.mp4

Firefox for iOS ignores Content-Disposition response headers and instead of downloading the file it will render it, this is different from 1976296 because Focus ignores Content-Type too but Firefox if it's application/octet-stream it will try to download it.

POC: https://rx23.io/poc/firefox/2.php

Comment 1

[Renwa]

Attachment: download-testcase.php

Comment 2

[mreagan]

A few quick notes

• It looks like this behavior may have been changed as part of https://bugzilla.mozilla.org/show_bug.cgi?id=1474339
• @dveditz pointed out that we should always be respecting Content-Disposition: attachment per RFC 2616:

  According to RFC 2616, the disposition type "attachment" only applies to content of type "application/octet-stream". This restriction has been removed, because recipients in practice do not check the content type, and it also discourages properly declaring the media type.

• There were some related refactors that took place as part of this fix: https://github.com/mozilla-mobile/firefox-ios/pull/24840
• Per discussions with @dveditz the plan for now is to always respect Content-Disposition: attachment

Comment 3

[Andrei Bodea[:andrei]]

Verified as fixed on v9000 (58916) (this v9000 is the latest main v142) with iPhone 15 Pro (18.5).
Based on the number added on the website, the number of webpages opened correctly.

• Video

Comment 4

[mreagan]

Attachment: advisory.txt