Closed Bug 1978453 (CVE-2025-10531) Opened 1 year ago Closed 1 year ago

CSP strict-dynamic bypass via shimmed Vidible video player

Categories

(Web Compatibility :: Tooling & Investigations, defect)

Product:
Web Compatibility
Component:
Tooling & Investigations
Type:
defect

Tracking

(firefox-esr115 wontfix, firefox-esr128 wontfix, firefox-esr140 wontfix, firefox141 wontfix, firefox142 wontfix, firefox143+ fixed)

Status:
RESOLVED FIXED
Milestone:
143 Branch
Tracking Flags:
Tracking Status
firefox-esr115 --- wontfix
firefox-esr128 --- wontfix
firefox-esr140 --- wontfix
firefox141 --- wontfix
firefox142 --- wontfix
firefox143 + fixed

People

(Reporter: deltaclock, Assigned: twisniewski)

References

Details

(Keywords: csectype-mitigation-bypass, reporter-external, sec-moderate, Whiteboard: [fixed in bug 1978466][adv-main143+])

Steps to reproduce:

Incomplete patch for bug 1909241.

Following the same preconditions as the above bug, when a page uses "vidible.js" and some HTML can be injected; CSP bypass could be possible since the shim only checks for scripts that contain the string delivery.vidible.tv/jsonp.
https://github.com/mozilla-firefox/firefox/blob/55ec080e4a37b7ae1f89267063eccd361cdd232d/browser/extensions/webcompat/shims/vidible.js#L154

Such an injected HTML example:

<script src="data:,alert(1);//delivery.vidible.tv/jsonp"></script>

After the user clicks on the shimmed player created, the bypass would trigger at https://github.com/mozilla-firefox/firefox/blob/55ec080e4a37b7ae1f89267063eccd361cdd232d/browser/extensions/webcompat/shims/vidible.js#L182

Expected results:

Since Vidible seems to be offline currently, this bug does not require a high priority fix.
Subsequently, I would support the idea of completely removing this shim.

Hmm. Thanks for the heads-up. I might as well remove this if the service is down. I'll do so in bz 1978466.

Ok, that patch has just landed, and so should be in the nightlies, and ride the train to Firefox 143.

Depends on: 1978466
Assignee: nobody → twisniewski
Status: UNCONFIRMED → RESOLVED
Closed: 1 year ago
Keywords: csectype-mitigation-bypass, sec-moderate
Resolution: --- → FIXED
Whiteboard: [fixed in bug 1978466]
Group: firefox-core-security → core-security-release
Target Milestone: --- → 143 Branch
QA Whiteboard: [sec] [qa-triage-done-c144/b143]
Whiteboard: [fixed in bug 1978466] → [fixed in bug 1978466][adv-main143+]
Alias: CVE-2025-10531
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.