Уязвимость перехвата запросов на защищённые страницы в Firefox с использованием service worker
Описание
Когда HTTPS-страница встраивается в HTTP-страницу, и для первой зарегистрирован service worker, этот service worker способен перехватить запросы к защищённой странице, несмотря на то, что iframe не является безопасным контекстом из-за (незащищённого) фрейминга.
Затронутые версии ПО
- Firefox версии ниже 84
Тип уязвимости
Перехват данных
Ссылки
- Issue TrackingPermissions RequiredVendor Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Vendor Advisory
- Issue TrackingPermissions RequiredVendor Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Vendor Advisory
Уязвимые конфигурации
Одно из
EPSS
6.5 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
Связанные уязвимости
When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have intercepted the request for the secure page despite the iframe not being a secure context due to the (insecure) framing. This vulnerability affects Firefox < 84.
When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have intercepted the request for the secure page despite the iframe not being a secure context due to the (insecure) framing. This vulnerability affects Firefox < 84.
When a HTTPS pages was embedded in a HTTP page, and there was a servic ...
When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have intercepted the request for the secure page despite the iframe not being a secure context due to the (insecure) framing. This vulnerability affects Firefox < 84.
EPSS
6.5 Medium
CVSS3
4.3 Medium
CVSS2