CVE-2020-15662
published 2020-08-10CVE-2020-15662: A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the user downloading an unintended file…
PriorityP428medium6.5CVSS 3.1
AVNACLPRNUIRSUCNIHAN
EPSS
0.67%
47.9th percentile
A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the user downloading an unintended file. This vulnerability affects Firefox for iOS < 28.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | — | — |
| mozilla | firefox | < 28.0 | 28.0 |
| mozilla | firefox | — | — |
| mozilla | firefox_for_ios | >= unspecified < 28 | 28 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_debian6.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vhp9-5mw9-c7wp: A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the user downloading an unintended
ghsa_unreviewed·2022-05-24
CVE-2020-15662 [MEDIUM] GHSA-vhp9-5mw9-c7wp: A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the user downloading an unintended
A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the user downloading an unintended file. This vulnerability affects Firefox for iOS < 28.
Debian
CVE-2020-15662: firefox - A rogue webpage could override the injected WKUserScript used by the download fe...
vendor_debian·2020·CVSS 6.5
CVE-2020-15662 [MEDIUM] CVE-2020-15662: firefox - A rogue webpage could override the injected WKUserScript used by the download fe...
A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the user downloading an unintended file. This vulnerability affects Firefox for iOS < 28.
Scope: local
sid: resolved
Mozilla
Mozilla Foundation Security Advisory 2020-34: CVE-2020-15662
vendor_mozilla·CVSS 6.5
CVE-2020-15662 [MEDIUM] Mozilla Foundation Security Advisory 2020-34: CVE-2020-15662
Mozilla Foundation Security Advisory 2020-34
CVE: CVE-2020-15662
Product: Firefox for iOS
Impact: low
Fixed in: Firefox for iOS 28
No detection rules found.
No public exploits indexed.
Bugzilla
The Context Menu for iOS Firefox can over ride on any origin allowing UXSS everywhere with bug id 1874910
bugzilla·2024-01-16
The Context Menu for iOS Firefox can over ride on any origin allowing UXSS everywhere with bug id 1874910
The Context Menu for iOS Firefox can over ride on any origin allowing UXSS everywhere with bug id 1874910
Created attachment 9373138
RPReplay_Final1705436547.mp4
We are able to over ride the context menu on target site resulting to UXSS with bug id 1874910.
I believe due to over ride on other origin part, the fix need to be separated and there are several scenarios without this UXSS we could abuse so I opened this new report.
Discussion:
Created attachment 9373139
1874964.html
---
This doesn't work on bugzilla attachment since it opens Facebook app instead of navigating to https://facebook.com for some reason.
Please test on https://pwning.click/ffdownuxss.php
---
Created attachment 9373194
RPReplay_Final1705476923.mp4
---
See bug 1874910 comment 5 for the testcase description,
Bugzilla
Rogue download handler can be injected by any web contents
bugzilla·2020-07-19
Rogue download handler can be injected by any web contents
Rogue download handler can be injected by any web contents
Created attachment 9164587
Demo cross_origin_data_leakage (Example A)
User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.2 Safari/605.1.15
Steps to reproduce:
Any web content can define rogue download handler (window.__firefox__.download).
That can be a cause of several security issue.
Example (A). Cross Origin URL Leakage
(1) Victim visits http://csrf.jp/2020/download_handler_injection_cross_origin_data_leakage.html .
This page has an that shows CERN's website (info.cern.ch).
(2) Victim long taps a hyperlink in the CERN's page and choose "Download Link" from context menu.
(3) Parent frame (csrf.jp) shows the URL that Victim tries to download in .
Example (B). Sec
2020-08-10
Published