CVE-2015-7184
published 2015-10-18CVE-2015-7184: The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials…
PriorityP432medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
1.66%
74.4th percentile
The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the CORS cross-origin request algorithm is improperly followed, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | <= 41.0.1 | — |
| mozilla | firefox | >= 0 < 41.0.2+build2-0ubuntu0.14.04.1 | 41.0.2+build2-0ubuntu0.14.04.1 |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv6.8MEDIUM
vendor_redhat7.5HIGH
vendor_ubuntu6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
ntp: Interleaved symmetric mode cannot recover from bad state
vendor_redhat·2018-02-27·CVSS 7.5
CVE-2018-7184 [HIGH] ntp: Interleaved symmetric mode cannot recover from bad state
ntp: Interleaved symmetric mode cannot recover from bad state
ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the most recent timestamp. This issue is a result of an incomplete fix for CVE-2015-7704.
Package: ntp (Red Hat Enterprise Linux 5) - Not affected
Package: ntp (Red Hat Enterprise Linux 6) - Not affected
Package: ntp (Red Hat Enterprise Linux 7) - Not affected
Package: ntp (Red Hat Enterprise Linux 8) - Fix deferred
Ubuntu
Firefox vulnerability
vendor_ubuntu·2015-10-16·CVSS 6.8
CVE-2015-7184 [MEDIUM] Firefox vulnerability
Title: Firefox vulnerability
Summary: Firefox could be made to expose sensitive information across origins
Abdulrahman Alqabandi and Ben Kelly discovered that the fetch() API did
not correctly implement the Cross Origin Resource Sharing (CORS)
specification. If a user were tricked in to opening a specially crafted
website, an attacker could potentially exploit this to obtain sensitive
information from other origins. (CVE-2015-7184)
Instructions: After a standard system update you need to restart Firefox to make
all the necessary changes.
Red Hat
firefox: cross-origin restriction bypass using Fetch
vendor_redhat·2015-10-15·CVSS 6.8
CVE-2015-7184 [MEDIUM] CWE-358 firefox: cross-origin restriction bypass using Fetch
firefox: cross-origin restriction bypass using Fetch
The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the CORS cross-origin request algorithm is improperly followed, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
Statement: This issue did not affect the versions of firefox as shipped with Red Hat Enterprise Linux 5, 6, and 7.
Package: firefox (Red Hat Enterprise Linux 5) - Not affected
Package: firefox (Red Hat Enterprise Linux 6) - Not affected
Package: firefox (Red Hat Enterprise Linux 7) - Not affected
GHSA
GHSA-xj5m-432r-gpqm: The fetch API implementation in Mozilla Firefox before 41
ghsa_unreviewed·2022-05-17
CVE-2015-7184 [MEDIUM] CWE-284 GHSA-xj5m-432r-gpqm: The fetch API implementation in Mozilla Firefox before 41
The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the CORS cross-origin request algorithm is improperly followed, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
OSV
CVE-2015-7184: The fetch API implementation in Mozilla Firefox before 41
osv·2015-10-18·CVSS 6.8
CVE-2015-7184 [MEDIUM] CVE-2015-7184: The fetch API implementation in Mozilla Firefox before 41
The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the CORS cross-origin request algorithm is improperly followed, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
OSV
firefox vulnerability
osv·2015-10-16·CVSS 6.8
CVE-2015-7184 [MEDIUM] firefox vulnerability
firefox vulnerability
Abdulrahman Alqabandi and Ben Kelly discovered that the fetch() API did
not correctly implement the Cross Origin Resource Sharing (CORS)
specification. If a user were tricked in to opening a specially crafted
website, an attacker could potentially exploit this to obtain sensitive
information from other origins. (CVE-2015-7184)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2015-7184 firefox: cross-origin restriction bypass using Fetch
bugzilla·2015-10-16·CVSS 6.8
CVE-2015-7184 [MEDIUM] CVE-2015-7184 firefox: cross-origin restriction bypass using Fetch
CVE-2015-7184 firefox: cross-origin restriction bypass using Fetch
A cross-origin restriction bypass flaw was found in Firefox:
Security researcher Abdulrahman Alqabandi reported that the fetch() API did not correctly implement the Cross-Origin Resource Sharing (CORS) specification, allowing a malicious page to access private data from other origins. Mozilla developer Ben Kelly independently reported the same issue.
This issue was fixed in Firefox 41.0.2.
Upstream bugs:
https://bugzilla.mozilla.org/show_bug.cgi?id=1208339
https://bugzilla.mozilla.org/show_bug.cgi?id=1212669
External References:
https://www.mozilla.org/en-US/security/advisories/mfsa2015-115/
Discussion:
Fixed in Fedora in packages:
firefox-41.0.2-2.fc23
firefox-41.0.2-2.fc21
firefox-41.0.2-2.fc24
firefox-41.0.2-2.
Bugzilla
Cross-Origin restriction bypass with fetch using 302 redirection
bugzilla·2015-09-25
[MEDIUM] Cross-Origin restriction bypass with fetch using 302 redirection
Cross-Origin restriction bypass with fetch using 302 redirection
Created attachment 8665773
PoC-FF.html
User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0
Build ID: 20150921151815
Steps to reproduce:
1. Create a 302 redirect on owned server (http://evil.guy/redir) which contains a 'Location:' header pointing to the victims website (ex: Location: https://twitter.com/)
2. Create page (http://evil.guy/PoC.html) that contains the exploit code as well as two iframes, one empty and one pointing to '//twitter.com/' directly. (please see attached PoC-FF.html)
3. Modify 'PoC-FF.html' replacing 'http://localhost/redir.php' with your own 302 redirector.
4. Visit 'http://evil.guy/PoC-FF.html'
Actual results:
- The iframe with href='//twitter.com/' is immedia
http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00021.htmlhttp://www.mozilla.org/security/announce/2015/mfsa2015-115.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlhttp://www.securityfocus.com/bid/77100http://www.securitytracker.com/id/1033820http://www.ubuntu.com/usn/USN-2768-1https://bugzilla.mozilla.org/show_bug.cgi?id=1208339https://bugzilla.mozilla.org/show_bug.cgi?id=1212669http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00021.htmlhttp://www.mozilla.org/security/announce/2015/mfsa2015-115.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlhttp://www.securityfocus.com/bid/77100http://www.securitytracker.com/id/1033820http://www.ubuntu.com/usn/USN-2768-1https://bugzilla.mozilla.org/show_bug.cgi?id=1208339https://bugzilla.mozilla.org/show_bug.cgi?id=1212669
2015-10-18
Published