Уязвимость обхода защиты от фишинга и вредоносного ПО через загрузку файлов с использованием элементов URL "blob:" и "data:" в Firefox и Thunderbird
Описание
Злоумышленники могут обойти стандартные проверки загрузки файлов, используя URL элементы blob: и data:. Это позволяет вредоносным сайтам заманивать пользователей на загрузку выполняемых файлов, которые в противном случае были бы определены как подозрительные. Защита от фишинга и вредоносного ПО, включая списки блокировки подозрительных сайтов и файлов, не срабатывает в таких случаях.
Затронутые версии ПО
- Firefox версии менее 56
- Firefox ESR версии менее 52.4
- Thunderbird версии менее 52.4
Тип уязвимости
- Обход защиты
- Скачивание опасных файлов
Ссылки
- Third Party AdvisoryVDB Entry
- Third Party AdvisoryVDB Entry
- Third Party Advisory
- Third Party Advisory
- Issue TrackingPatchThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Third Party AdvisoryVDB Entry
- Third Party AdvisoryVDB Entry
- Third Party Advisory
- Third Party Advisory
- Issue TrackingPatchThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Одно из
Одно из
Одно из
EPSS
7.8 High
CVSS3
6.8 Medium
CVSS2
Дефекты
Связанные уязвимости
File downloads encoded with "blob:" and "data:" URL elements bypassed normal file download checks though the Phishing and Malware Protection feature and its block lists of suspicious sites and files. This would allow malicious sites to lure users into downloading executables that would otherwise be detected as suspicious. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.
File downloads encoded with "blob:" and "data:" URL elements bypassed normal file download checks though the Phishing and Malware Protection feature and its block lists of suspicious sites and files. This would allow malicious sites to lure users into downloading executables that would otherwise be detected as suspicious. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.
File downloads encoded with "blob:" and "data:" URL elements bypassed ...
File downloads encoded with "blob:" and "data:" URL elements bypassed normal file download checks though the Phishing and Malware Protection feature and its block lists of suspicious sites and files. This would allow malicious sites to lure users into downloading executables that would otherwise be detected as suspicious. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.
Уязвимость реализации функции защиты от вредоносных сайтов и фишинга Phishing and Malware Protection браузеров Mozilla Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю проводить фишинг-атаки
EPSS
7.8 High
CVSS3
6.8 Medium
CVSS2