CVE-2011-2362 in Firefox
Summary
by MITRE
Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 do not distinguish between cookies for two domain names that differ only in a trailing dot, which allows remote web servers to bypass the Same Origin Policy via Set-Cookie headers.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/13/2021
This vulnerability exists in Mozilla Firefox versions prior to 3.6.18, Thunderbird versions prior to 3.1.11, and SeaMonkey versions through 2.0.14, representing a critical security flaw in web browser cookie handling mechanisms. The issue stems from the browsers' inability to properly differentiate between cookies set for domain names that vary only by a trailing dot, creating a significant bypass of the fundamental Same Origin Policy that governs web security. This flaw allows malicious web servers to manipulate cookie storage in ways that could compromise user sessions and data confidentiality.
The technical root cause lies in the cookie domain parsing logic where browsers treat domain names such as example.com and example.com. as equivalent, despite the trailing dot indicating a distinct domain in DNS terminology. This behavior violates the established cookie specification standards and creates a pathway for cross-site scripting attacks. When a web server sets a cookie with a domain value ending in a dot, the browser incorrectly stores it in the same cookie jar as a cookie without the trailing dot, effectively allowing unauthorized access to session data across what should be distinct domain boundaries.
The operational impact of this vulnerability is severe as it enables attackers to perform session hijacking and cross-site request forgery attacks. An attacker could exploit this weakness by setting a cookie for a target domain with a trailing dot, then manipulate other domains to access that cookie data. This creates a vector for stealing authentication tokens, session identifiers, and other sensitive information that should remain isolated between different web origins. The vulnerability particularly affects web applications that rely heavily on cookie-based authentication mechanisms and session management.
From a cybersecurity framework perspective, this vulnerability maps to CWE-200 (Information Exposure) and CWE-284 (Improper Access Control) within the Common Weakness Enumeration catalog. The attack pattern aligns with techniques described in the MITRE ATT&CK framework under T1185 (Multi-Factor Authentication Interception) and T1071.004 (Application Layer Protocol: DNS) as attackers can leverage this weakness to manipulate DNS-based cookie storage. Organizations should implement immediate patch management procedures to upgrade affected browser versions, while security teams should monitor for potential exploitation attempts and consider implementing additional network-level protections such as cookie security headers and Content Security Policies.
The remediation strategy requires organizations to ensure all affected browsers are updated to versions that properly distinguish between domain names with and without trailing dots. System administrators should also review existing cookie handling practices and implement proper security headers including Secure and HttpOnly flags on all session cookies. Additionally, network monitoring solutions should be configured to detect anomalous cookie behavior patterns that might indicate exploitation attempts. This vulnerability demonstrates the critical importance of proper cookie domain validation and highlights how seemingly minor implementation details can create significant security weaknesses in web browser security models.