cbcvebase.
CVE-2013-0757
published 2013-01-13

CVE-2013-0757: The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x…

PriorityP264critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
60.86%
99.1th percentile
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not prevent modifications to the prototype of an object, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by referencing Object.prototype.__proto__ in a crafted HTML document.

Affected

18 ranges
VendorProductVersion rangeFixed in
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
mozillafirefox< 17.0.217.0.2
mozillafirefox< 18.018.0
mozillaseamonkey< 2.152.15
mozillathunderbird< 17.0.217.0.2
mozillathunderbird_esr< 17.0.217.0.2
opensuseopensuse
opensuseopensuse
opensuseopensuse
suselinux_enterprise_desktop
suselinux_enterprise_desktop
suselinux_enterprise_server
suselinux_enterprise_server
suselinux_enterprise_software_development_kit
suselinux_enterprise_software_development_kit

Detection & IOCsextracted from sources · hover to see the quote

pathdata/exploits/cve-2013-0758.swf
commandObject.prototype.__lookupSetter__("__proto__").call(p, o);
commandvar p = Object.getPrototypeOf(frames[0]); var o = {__exposedProps__: {setTimeout: "rw", call: "rw"}}; Object.prototype.__lookupSetter__("__proto__").call(p, o); p.setTimeout.call(frames[0], c, 1);
  • Detect exploit attempts by monitoring JavaScript for use of Object.prototype.__proto__ manipulation combined with __lookupSetter__ calls targeting frame window objects, which is the core CVE-2013-0757 bypass technique.
  • Look for JavaScript payloads that call Object.getPrototypeOf() on a cross-frame reference (e.g., frames[0]) followed immediately by __lookupSetter__("__proto__") to overwrite the prototype with a crafted __exposedProps__ object granting 'rw' access to setTimeout.
  • The exploit chains CVE-2013-0758 (SVG 'use' element cloning a Flash object to navigate a child frame to chrome://) with CVE-2013-0757 (COW bypass). Detect requests for a .swf file immediately followed by an HTML page containing SVG 'use' and 'object' elements from the same origin.
  • The Metasploit module targets Firefox User-Agent matching /17\..*/ with Flash present. Network-level detection should flag HTTP responses serving application/x-shockwave-flash to Firefox 17.x User-Agents in conjunction with HTML pages containing SVG xlink:href manipulation.
  • Monitor for setInterval-based polling loops in JavaScript that catch exceptions on cross-frame property access ('access' string) as a precursor to the prototype-swap exploit primitive.
  • ·The exploit requires the victim to have Adobe Flash installed in addition to a vulnerable Firefox 17.x browser; without Flash (or another scriptable plugin), CVE-2013-0757 alone cannot be triggered via this Metasploit module.
  • ·In Thunderbird and SeaMonkey, the vulnerability is generally not exploitable via email because scripting is disabled by default; risk is limited to browser or browser-like contexts.
  • ·Red Hat Enterprise Linux 5 and 6 ship versions of Firefox and Thunderbird that are not affected by CVE-2013-0757.

CVSS provenance

nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_redhat9.3CRITICAL
vendor_ubuntu9.3CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.