Mozilla Firefox HTML5 information exposure

Summaryinfo

A vulnerability marked as problematic has been reported in Mozilla Firefox. Affected by this issue is some unknown functionality of the component HTML5 Handler. This manipulation causes information exposure. Furthermore, an exploit is available.

Detailsinfo

A vulnerability classified as problematic was found in Mozilla Firefox (Web Browser) (the affected version is unknown). Affected by this vulnerability is an unknown code of the component HTML5 Handler. The manipulation with an unknown input leads to a information exposure vulnerability. The CWE definition for the vulnerability is CWE-203. The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not. As an impact it is known to affect confidentiality.

The weakness was published 06/05/2014 by Paul Stone with Context Information Security as Pixel Perfect Timing Attacks with HTML5 as confirmed paper (Website). The advisory is shared at contextis.com. The public release has been coordinated with Mozilla. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are unknown but a public exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue. The advisory points out:

This paper describes a number of timing attack techniques that can be used by a malicious web page to steal sensitive data from a browser, breaking cross-origin restrictions. The new requestAnimationFrame API can be used to time browser rendering operations and infer sensitive data based on timing data. The first technique allows the browser history to be sniffed by detecting redraw events. The second part of the paper shows how SVG filters are vulnerable to a timing attack that can be used to read pixel values from a web page. This allows pixels from cross-origin iframes to be read using an OCR-style technique to obtain sensitive data from websites.

A public exploit has been developed by Paul Stone in HTML and been published immediately after the advisory. It is possible to download the exploit at contextis.com. It is declared as proof-of-concept. We expect the 0-day to have been worth approximately $25k-$100k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Additional details are provided at arstechnica.com. Similar entries are available at VDB-13466 and VDB-13464. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Web Browser

Vendor

• Mozilla

Name

• Firefox

License

• open-source

Website

• Vendor: https://www.mozilla.org/
• Product: https://www.mozilla.org/en-US/firefox/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion