CVE-2007-6589 in before
Summary
by MITRE
The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 does not update the origin domain when retrieving the inner URL parameter yields an HTTP redirect, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a jar: URI, a different vulnerability than CVE-2007-5947.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/12/2017
The vulnerability described in CVE-2007-6589 represents a critical security flaw in the jar protocol handler implementation within Mozilla Firefox and SeaMonkey browsers. This issue stems from improper handling of HTTP redirects when processing jar: URIs, creating a significant bypass of the browser's security model. The flaw specifically affects versions prior to Firefox 2.0.0.10 and SeaMonkey 1.1.7, indicating this was a well-known vulnerability that required immediate patching to prevent exploitation by malicious actors.
The technical root cause lies in how the browser's jar protocol handler manages the origin domain validation during HTTP redirect scenarios. When a jar: URI is processed and the inner URL parameter results in an HTTP redirect, the protocol handler fails to properly update the origin domain information. This failure creates a window where the browser's security context becomes inconsistent, allowing an attacker to manipulate the security boundaries that normally protect against cross-site scripting attacks. The vulnerability operates through a different mechanism than CVE-2007-5947, making it a distinct but equally dangerous flaw in the browser's security architecture.
The operational impact of this vulnerability is severe as it enables remote attackers to execute cross-site scripting attacks through carefully crafted jar: URIs. Attackers can exploit this weakness by crafting malicious jar: URIs that, when processed by the vulnerable browser, bypass the normal security restrictions that prevent scripts from executing across different domains. This creates an environment where malicious content can be injected into web pages, potentially leading to session hijacking, data theft, or complete browser compromise. The vulnerability essentially allows attackers to circumvent the same-origin policy that forms the foundation of web browser security.
This security flaw maps directly to CWE-79 Cross-site Scripting and aligns with ATT&CK technique T1211 Command and Scripting Interpreter, specifically targeting the browser's protocol handling mechanisms. The vulnerability demonstrates how improper input validation and security context management can create persistent attack vectors. Organizations and users were strongly advised to upgrade to the patched versions immediately, as the vulnerability could be exploited through various attack vectors including malicious web pages, email attachments, or compromised websites. The fix implemented by Mozilla and SeaMonkey developers involved ensuring proper origin domain updates during HTTP redirect handling, thereby maintaining the integrity of the browser's security model and preventing unauthorized cross-site scripting attacks.