Уязвимость доступа к файлам через локально сохранённый HTML-файл с использованием протокола "file:" в Mozilla Firefox и Thunderbird
Описание
Существует уязвимость, при которой, если пользователь открывает локально сохранённый HTML-файл, этот файл может использовать URI file: для доступа к другим файлам в той же директории или поддиректориях, если их имена известны или угаданы. API Fetch может затем использоваться для чтения содержимого любых файлов, хранящихся в этих директориях, и их загрузки на сервер. Было продемонстрировано, что в сочетании с популярным приложением для обмена сообщениями на Android, при отправке пользователю вредоносного HTML-вложения и его открытии в Firefox, возможно чтение вложений, полученных жертвой от других корреспондентов, из-за предсказуемого шаблона имен локально сохранённых файлов этого приложения.
Затронутые версии ПО
- Firefox ESR версий до 60.8
- Firefox версий до 68
- Thunderbird версий до 60.8
Тип уязвимости
Утечка данных
Ссылки
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Issue TrackingPermissions Required
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- Vendor Advisory
- Vendor Advisory
- Vendor Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Issue TrackingPermissions Required
- Mailing ListThird Party Advisory
Уязвимые конфигурации
Одно из
Одно из
Одновременно
EPSS
6.5 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
Связанные уязвимости
A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names are known or guessed. The Fetch API can then be used to read the contents of any files stored in these directories and they may uploaded to a server. It was demonstrated that in combination with a popular Android messaging app, if a malicious HTML attachment is sent to a user and they opened that attachment in Firefox, due to that app's predictable pattern for locally-saved file names, it is possible to read attachments the victim received from other correspondents. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names are known or guessed. The Fetch API can then be used to read the contents of any files stored in these directories and they may uploaded to a server. It was demonstrated that in combination with a popular Android messaging app, if a malicious HTML attachment is sent to a user and they opened that attachment in Firefox, due to that app's predictable pattern for locally-saved file names, it is possible to read attachments the victim received from other correspondents. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
A vulnerability exists where if a user opens a locally saved HTML file ...
A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names are known or guessed. The Fetch API can then be used to read the contents of any files stored in these directories and they may uploaded to a server. It was demonstrated that in combination with a popular Android messaging app, if a malicious HTML attachment is sent to a user and they opened that attachment in Firefox, due to that app's predictable pattern for locally-saved file names, it is possible to read attachments the victim received from other correspondents. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
Уязвимость веб-браузеров Firefox, Firefox ESR и программы для работы с электронной почтой Thunderbird, связанная с отсутствием защиты служебных данных, позволяющая нарушителю получить несанкционированный доступ к конфиденциальным данным
EPSS
6.5 Medium
CVSS3
4.3 Medium
CVSS2