Mozilla Firefox up to 65.x UIR Request origin validation

Summaryinfo

A vulnerability was found in Mozilla Firefox up to 65.x. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the component UIR Handler. This manipulation as part of Request causes origin validation. This vulnerability is tracked as CVE-2019-9803. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in Mozilla Firefox up to 65.x (Web Browser) and classified as critical. Affected by this vulnerability is an unknown code block of the component UIR Handler. The manipulation as part of a Request leads to a origin validation vulnerability. The CWE definition for the vulnerability is CWE-346. The product does not properly verify that the source of data or communication is valid. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The Upgrade-Insecure-Requests (UIR) specification states that if UIR is enabled through Content Security Policy (CSP), navigation to a same-origin URL must be upgraded to HTTPS. Firefox will incorrectly navigate to an HTTP URL rather than perform the security upgrade requested by the CSP in some circumstances, allowing for potential man-in-the-middle attacks on the linked resources. This vulnerability affects Firefox < 66.

The bug was discovered 03/19/2019. The weakness was disclosed 04/26/2019. This vulnerability is known as CVE-2019-9803 since 03/14/2019. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 38 days. During that time the estimated underground price was around $5k-$25k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 197402 (Ubuntu Security Notification for Firefox Vulnerabilities (USN-3918-1)).

Upgrading to version 66.0 eliminates this vulnerability.

The entries VDB-134154, VDB-134162, VDB-134164 and VDB-134166 are pretty similar. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Web Browser

Vendor

• Mozilla

Name

• Firefox

Version

• 65.x

License

• open-source

Website

• Vendor: https://www.mozilla.org/
• Product: https://www.mozilla.org/en-US/firefox/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion