Closed
Bug 2015353
Opened 9 months ago
Closed 9 months ago
RecvLoadURI accepts forged triggeringPrincipal — full local file read + exfiltration
Categories
(Core :: DOM: Content Processes, defect)
Core
DOM: Content Processes
Tracking
()
RESOLVED
DUPLICATE
of bug 2010310
People
(Reporter: kerberoasting, Unassigned)
Details
(Keywords: ai-involved, reporter-external, Whiteboard: [client-bounty-form])
Attachments
(1 file)
|
8.40 KB,
text/markdown
|
Details |
Hello. WindowGlobalParent::RecvLoadURI performs zero validation on triggeringPrincipal in the received nsDocShellLoadState. A compromised content process forges SystemPrincipal as the triggering principal, enabling navigation to file:// URIs. Combined with a controlled HTML file (e.g., auto-downloaded), this yields arbitrary local file read with network exfiltration — stealing /etc/passwd, ~/.ssh/id_rsa, Firefox profile data (cookies.sqlite, logins.json, key4.db), and more.
I tried to test this to full extent of my abilities and also also tried to make the attachment less verbose based on previous feedback. Thanks!
Flags: sec-bounty?
|
||
Updated•9 months ago
|
Group: firefox-core-security → dom-core-security
Component: Security → DOM: Content Processes
Product: Firefox → Core
|
||
Updated•9 months ago
|
Status: UNCONFIRMED → RESOLVED
Closed: 9 months ago
Duplicate of bug: 2010310
Keywords: ai-involved
Resolution: --- → DUPLICATE
|
||
Updated•9 months ago
|
Flags: sec-bounty? → sec-bounty-
|
|
||
Updated•8 months ago
|
Group: dom-core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•