CVE-2017-7830
published 2018-06-11CVE-2017-7830: The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs…
PriorityP429medium6.5CVSS 3.0
AVNACLPRNUIRSUCHINAN
EPSS
2.48%
82.8th percentile
The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs loaded by users. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5.
Affected
41 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | icloud_for_windows | — | — |
| apple | ios | — | — |
| apple | itunes_12.7.3_for_windows | — | — |
| apple | macos_high_sierra_10.13.3_security_update_2018-001_sierra_and_security_update_20 | — | — |
| apple | safari | — | — |
| apple | tvos | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | firefox | < firefox 57.0-1 (sid) | firefox 57.0-1 (sid) |
| debian | firefox-esr | < firefox 57.0-1 (sid) | firefox 57.0-1 (sid) |
| debian | thunderbird | < firefox 57.0-1 (sid) | firefox 57.0-1 (sid) |
| mozilla | firefox | < 57.0 | 57.0 |
| mozilla | firefox | < 52.5.0 | 52.5.0 |
| mozilla | firefox | >= 0 < 57.0+build4-0ubuntu0.14.04.4 | 57.0+build4-0ubuntu0.14.04.4 |
| mozilla | firefox | >= 0 < 57.0.3+build1-0ubuntu0.14.04.1 | 57.0.3+build1-0ubuntu0.14.04.1 |
| mozilla | firefox | >= 0 < 57.0+build4-0ubuntu0.14.04.5 | 57.0+build4-0ubuntu0.14.04.5 |
| mozilla | firefox | >= 0 < 57.0.1+build2-0ubuntu0.14.04.1 | 57.0.1+build2-0ubuntu0.14.04.1 |
| mozilla | firefox | >= 0 < 57.0+build4-0ubuntu0.16.04.5 | 57.0+build4-0ubuntu0.16.04.5 |
| mozilla | firefox | >= 0 < 57.0.3+build1-0ubuntu0.16.04.1 | 57.0.3+build1-0ubuntu0.16.04.1 |
| mozilla | firefox | >= 0 < 57.0+build4-0ubuntu0.16.04.6 | 57.0+build4-0ubuntu0.16.04.6 |
| mozilla | firefox | >= 0 < 57.0.1+build2-0ubuntu0.16.04.1 | 57.0.1+build2-0ubuntu0.16.04.1 |
| mozilla | firefox | >= unspecified < 57 | 57 |
| mozilla | firefox_esr | >= unspecified < 52.5 | 52.5 |
| mozilla | thunderbird | < 52.5.0 | 52.5.0 |
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
osv9.8CRITICAL
vendor_ubuntu9.8CRITICAL
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apple
CVE-2017-7830: iOS 11.2.5
vendor_apple·2018-01-23·CVSS 6.5
CVE-2017-7830 [MEDIUM] CVE-2017-7830: iOS 11.2.5
Apple Security Update: About the security content of iOS 11.2.5
Product: iOS
Version: 11.2.5
CVE: CVE-2017-7830
Component: WebKit Page Loading
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: Multiple memory corruption issues were addressed with improved memory handling.
Apple
CVE-2017-7830: macOS High Sierra 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan
vendor_apple·2018-01-23·CVSS 6.5
CVE-2017-7830 [MEDIUM] CVE-2017-7830: macOS High Sierra 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan
Apple Security Update: About the security content of macOS High Sierra 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan
Product: macOS High Sierra 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan
CVE: CVE-2017-7830
Component: WebKit Page Loading
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: Multiple memory corruption issues were addressed with improved memory handling.
Apple
CVE-2017-7830: iTunes 12.7.3 for Windows
vendor_apple·2018-01-23·CVSS 6.5
CVE-2017-7830 [MEDIUM] CVE-2017-7830: iTunes 12.7.3 for Windows
Apple Security Update: About the security content of iTunes 12.7.3 for Windows
Product: iTunes 12.7.3 for Windows
CVE: CVE-2017-7830
Component: WebKit Page Loading
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: Multiple memory corruption issues were addressed with improved memory handling.
Apple
CVE-2017-7830: iCloud for Windows 7.3
vendor_apple·2018-01-23·CVSS 6.5
CVE-2017-7830 [MEDIUM] CVE-2017-7830: iCloud for Windows 7.3
Apple Security Update: About the security content of iCloud for Windows 7.3
Product: iCloud for Windows
Version: 7.3
CVE: CVE-2017-7830
Component: WebKit Page Loading
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: Multiple memory corruption issues were addressed with improved memory handling.
Apple
CVE-2017-7830: Safari 11.0.3
vendor_apple·2018-01-23·CVSS 6.5
CVE-2017-7830 [MEDIUM] CVE-2017-7830: Safari 11.0.3
Apple Security Update: About the security content of Safari 11.0.3
Product: Safari
Version: 11.0.3
CVE: CVE-2017-7830
Component: WebKit
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: Multiple memory corruption issues were addressed with improved memory handling.
Apple
CVE-2017-7830: tvOS 11.2.5
vendor_apple·2018-01-23·CVSS 6.5
CVE-2017-7830 [MEDIUM] CVE-2017-7830: tvOS 11.2.5
Apple Security Update: About the security content of tvOS 11.2.5
Product: tvOS
Version: 11.2.5
CVE: CVE-2017-7830
Component: WebKit Page Loading
Impact: Processing maliciously crafted web content may lead to arbitrary code execution
Description: Multiple memory corruption issues were addressed with improved memory handling.
Ubuntu
Firefox regression
vendor_ubuntu·2018-01-03·CVSS 9.8
[CRITICAL] Firefox regression
Title: Firefox regression
Summary: USN-3477-1 caused a regression in Firefox.
USN-3477-1 fixed vulnerabilities in Firefox. The update introduced a
crash reporting issue where background tab crash reports were sent to
Mozilla without user opt-in. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, read uninitialized
memory, obtain sensitive information, bypass same-origin restrictions,
bypass CSP protections, bypass mixed content blocking, spoof the
addressbar, or execute arbitrary code. (CVE-2017-7826, CVE-2017-7827,
CVE-2017-7828, CVE-2017-7830, CVE-201
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2017-12-01·CVSS 9.8
CVE-2017-7826 [CRITICAL] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
Multiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted website in a browsing-like
context, an attacker could potentially exploit these to bypass same-origin
restrictions, cause a denial of service via application crash, or execute
arbitrary code. (CVE-2017-7826, CVE-2017-7828, CVE-2017-7830)
Instructions: After a standard system update you need to restart Thunderbird to make
all the necessary changes.
Ubuntu
Firefox regressions
vendor_ubuntu·2017-12-01·CVSS 9.8
[CRITICAL] Firefox regressions
Title: Firefox regressions
Summary: USN-3477-1 caused some minor regressions in Firefox.
USN-3477-1 fixed vulnerabilities in Firefox. The update introduced various
minor regressions. This update fixes the problems.
We apologize for the inconvenience.
Original advisory details:
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, read uninitialized
memory, obtain sensitive information, bypass same-origin restrictions,
bypass CSP protections, bypass mixed content blocking, spoof the
addressbar, or execute arbitrary code. (CVE-2017-7826, CVE-2017-7827,
CVE-2017-7828, CVE-2017-7830, CVE-2017-7831, CVE-2017-7832, CVE-2017-7833,
CVE-2017-7834, CVE-2017-
Ubuntu
Firefox regression
vendor_ubuntu·2017-11-27·CVSS 9.8
[CRITICAL] Firefox regression
Title: Firefox regression
Summary: USN-3477-1 caused a regression in Firefox.
USN-3477-1 fixed vulnerabilities in Firefox. The update caused search
suggestions to not be displayed when performing Google searches from the
search bar. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, read uninitialized
memory, obtain sensitive information, bypass same-origin restrictions,
bypass CSP protections, bypass mixed content blocking, spoof the
addressbar, or execute arbitrary code. (CVE-2017-7826, CVE-2017-7827,
CVE-2017-7828, CVE-2017-7830, CVE-2017-7831, CVE-2
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2017-11-16·CVSS 9.8
CVE-2017-7826 [CRITICAL] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox could be made to crash or run programs as your login if it
opened a malicious website.
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, read uninitialized
memory, obtain sensitive information, bypass same-origin restrictions,
bypass CSP protections, bypass mixed content blocking, spoof the
addressbar, or execute arbitrary code. (CVE-2017-7826, CVE-2017-7827,
CVE-2017-7828, CVE-2017-7830, CVE-2017-7831, CVE-2017-7832, CVE-2017-7833,
CVE-2017-7834, CVE-2017-7835, CVE-2017-7837, CVE-2017-7838, CVE-2017-7842)
It was discovered that javascript: URLs pasted in to the addressbar
would be executed instead
Red Hat
Mozilla: Cross-origin URL information leak through Resource Timing API (MFSA 2017-25)
vendor_redhat·2017-11-15·CVSS 6.5
CVE-2017-7830 [MEDIUM] CWE-200 Mozilla: Cross-origin URL information leak through Resource Timing API (MFSA 2017-25)
Mozilla: Cross-origin URL information leak through Resource Timing API (MFSA 2017-25)
The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs loaded by users. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5.
Debian
CVE-2017-7830: firefox - The Resource Timing API incorrectly revealed navigations in cross-origin iframes...
vendor_debian·2017·CVSS 6.5
CVE-2017-7830 [MEDIUM] CVE-2017-7830: firefox - The Resource Timing API incorrectly revealed navigations in cross-origin iframes...
The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs loaded by users. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5.
Scope: local
sid: resolved (fixed in 57.0-1)
GHSA
GHSA-6j6p-p8wc-9jpp: The Resource Timing API incorrectly revealed navigations in cross-origin iframes
ghsa_unreviewed·2022-05-13
CVE-2017-7830 [MEDIUM] GHSA-6j6p-p8wc-9jpp: The Resource Timing API incorrectly revealed navigations in cross-origin iframes
The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs loaded by users. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5.
OSV
CVE-2017-7830: The Resource Timing API incorrectly revealed navigations in cross-origin iframes
osv·2018-06-11·CVSS 6.5
CVE-2017-7830 [MEDIUM] CVE-2017-7830: The Resource Timing API incorrectly revealed navigations in cross-origin iframes
The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs loaded by users. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5.
OSV
firefox regression
osv·2018-01-03·CVSS 9.8
[CRITICAL] firefox regression
firefox regression
USN-3477-1 fixed vulnerabilities in Firefox. The update introduced a
crash reporting issue where background tab crash reports were sent to
Mozilla without user opt-in. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, read uninitialized
memory, obtain sensitive information, bypass same-origin restrictions,
bypass CSP protections, bypass mixed content blocking, spoof the
addressbar, or execute arbitrary code. (CVE-2017-7826, CVE-2017-7827,
CVE-2017-7828, CVE-2017-7830, CVE-2017-7831, CVE-2017-7832, CVE-2017-7833,
CVE-2017-7834, CVE-201
OSV
thunderbird vulnerabilities
osv·2017-12-01·CVSS 9.8
CVE-2017-7826 [CRITICAL] thunderbird vulnerabilities
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted website in a browsing-like
context, an attacker could potentially exploit these to bypass same-origin
restrictions, cause a denial of service via application crash, or execute
arbitrary code. (CVE-2017-7826, CVE-2017-7828, CVE-2017-7830)
OSV
firefox regressions
osv·2017-12-01·CVSS 9.8
[CRITICAL] firefox regressions
firefox regressions
USN-3477-1 fixed vulnerabilities in Firefox. The update introduced various
minor regressions. This update fixes the problems.
We apologize for the inconvenience.
Original advisory details:
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, read uninitialized
memory, obtain sensitive information, bypass same-origin restrictions,
bypass CSP protections, bypass mixed content blocking, spoof the
addressbar, or execute arbitrary code. (CVE-2017-7826, CVE-2017-7827,
CVE-2017-7828, CVE-2017-7830, CVE-2017-7831, CVE-2017-7832, CVE-2017-7833,
CVE-2017-7834, CVE-2017-7835, CVE-2017-7837, CVE-2017-7838, CVE-2017-7842)
It was discovered
OSV
firefox regression
osv·2017-11-27·CVSS 9.8
[CRITICAL] firefox regression
firefox regression
USN-3477-1 fixed vulnerabilities in Firefox. The update caused search
suggestions to not be displayed when performing Google searches from the
search bar. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, read uninitialized
memory, obtain sensitive information, bypass same-origin restrictions,
bypass CSP protections, bypass mixed content blocking, spoof the
addressbar, or execute arbitrary code. (CVE-2017-7826, CVE-2017-7827,
CVE-2017-7828, CVE-2017-7830, CVE-2017-7831, CVE-2017-7832, CVE-2017-7833,
CVE-2017-7834, CVE-2017-7835, CVE-2
OSV
firefox vulnerabilities
osv·2017-11-16·CVSS 9.8
CVE-2017-7826 [CRITICAL] firefox vulnerabilities
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, read uninitialized
memory, obtain sensitive information, bypass same-origin restrictions,
bypass CSP protections, bypass mixed content blocking, spoof the
addressbar, or execute arbitrary code. (CVE-2017-7826, CVE-2017-7827,
CVE-2017-7828, CVE-2017-7830, CVE-2017-7831, CVE-2017-7832, CVE-2017-7833,
CVE-2017-7834, CVE-2017-7835, CVE-2017-7837, CVE-2017-7838, CVE-2017-7842)
It was discovered that javascript: URLs pasted in to the addressbar
would be executed instead of being blocked in some circumstances. If a
user were tricked in to copying a specially crafted URL in to the
a
No detection rules found.
Bugzilla
Stealing of URL cross-domain using performance.getEntries() once again, treat meta refresh channel as a redirect by setting result principal URL
bugzilla·2018-06-13
[MEDIUM] Stealing of URL cross-domain using performance.getEntries() once again, treat meta refresh channel as a redirect by setting result principal URL
Stealing of URL cross-domain using performance.getEntries() once again, treat meta refresh channel as a redirect by setting result principal URL
User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.79 Safari/537.36
Steps to reproduce:
IMO, the fix for the following issue is incomplete: https://bugzilla.mozilla.org/show_bug.cgi?id=1246956
We can still access to the Cross-Origin URL, which should be blocked.
This issue has been found in Microsoft Edge too.
Proof Of Concept:
redireg.html:
setTimeout(function(){alert(performance.getEntriesByType("resource")[1].name)},5000);
Type anything into the address bar and press ENTER!
Then I'll figure out your secret search!
con.html:
histback.html:
history.back();
Test live o
Bugzilla
CVE-2017-7830 Mozilla: Cross-origin URL information leak through Resource Timing API (MFSA 2017-25)
bugzilla·2017-11-15·CVSS 6.5
CVE-2017-7830 [MEDIUM] CVE-2017-7830 Mozilla: Cross-origin URL information leak through Resource Timing API (MFSA 2017-25)
CVE-2017-7830 Mozilla: Cross-origin URL information leak through Resource Timing API (MFSA 2017-25)
The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs loaded by users.
External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-25/#CVE-2017-7830
Discussion:
Acknowledgments:
Name: the Mozilla project
Upstream: Jun Kokatsu
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Via RHSA-2017:3247 https://access.redhat.com/errata/RHSA-2017:3247
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Via RHSA-2017:3372 https://access.red
Bugzilla
Resource Timing API leaks URL after subframe navigation
bugzilla·2017-10-16
[MEDIUM] Resource Timing API leaks URL after subframe navigation
Resource Timing API leaks URL after subframe navigation
User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Steps to reproduce:
1. Go to https://attack.shhnjk.com/resource_check.html
2. Wait for 3 seconds
Actual results:
Cross-origin URL after redirect is leaked.
Expected results:
This should not be leaked.
Discussion:
Seems very similar to https://bugzilla.mozilla.org/show_bug.cgi?id=1185256 but my PoC does not use cache. Is it regression?
---
Dragana: you fixed bug 1185256, is this similar and in your area?
---
taking it.
---
This problem are not redirects. The redirects are handle correctly, i.e. we do not show uri of redirects only the originalURI.
The resource at the address indicated by ifram
http://www.securityfocus.com/bid/101832http://www.securitytracker.com/id/1039803https://access.redhat.com/errata/RHSA-2017:3247https://access.redhat.com/errata/RHSA-2017:3372https://bugzilla.mozilla.org/show_bug.cgi?id=1408990https://lists.debian.org/debian-lts-announce/2017/11/msg00018.htmlhttps://lists.debian.org/debian-lts-announce/2017/12/msg00001.htmlhttps://www.debian.org/security/2017/dsa-4035https://www.debian.org/security/2017/dsa-4061https://www.debian.org/security/2017/dsa-4075https://www.mozilla.org/security/advisories/mfsa2017-24/https://www.mozilla.org/security/advisories/mfsa2017-25/https://www.mozilla.org/security/advisories/mfsa2017-26/http://www.securityfocus.com/bid/101832http://www.securitytracker.com/id/1039803https://access.redhat.com/errata/RHSA-2017:3247https://access.redhat.com/errata/RHSA-2017:3372https://bugzilla.mozilla.org/show_bug.cgi?id=1408990https://lists.debian.org/debian-lts-announce/2017/11/msg00018.htmlhttps://lists.debian.org/debian-lts-announce/2017/12/msg00001.htmlhttps://www.debian.org/security/2017/dsa-4035https://www.debian.org/security/2017/dsa-4061https://www.debian.org/security/2017/dsa-4075https://www.mozilla.org/security/advisories/mfsa2017-24/https://www.mozilla.org/security/advisories/mfsa2017-25/https://www.mozilla.org/security/advisories/mfsa2017-26/
2018-06-11
Published