0-day attack on Firefox stole sensitive data and password
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2015-4495 | Same-Origin Policy Bypass in Mozilla Firefox Allows Arbitrary File Reading CVE-2015-4495 is a security feature (same-origin policy) bypass in the PDF viewer bundled with Mozilla Firefox. It is triggered when a user opens a maliciously crafted PDF document in Firefox, which lets the document's JavaScript escape the PDF viewer's origin restrictions. A successful attacker can read arbitrary files from the user's system and, in some environments (notably Windows, where helper applications can be launched), gain privileges or execute code; the observed in-the-wild attacks stole sensitive data and passwords. Any user running an affected Firefox build is affected; the flaw was exploited as a 0-day in August 2015 and CISA added it to the Known Exploited Vulnerabilities catalog on 2022-05-25 (ransomware use unknown). EPSS currently assigns a 71.4% probability of exploitation within the next 30 days, and the required action is to apply updates per vendor instructions. Do: Update Firefox to at least version 39.0.3, Firefox ESR 38.1.1, or Firefox ESR 31.8 (any later release also contains this 2015 fix); the priority is auditing for and upgrading legacy Firefox installations to satisfy the CISA KEV required action. Until patched, discourage users from opening PDFs from untrusted sources in Firefox, since a crafted PDF opened in the built-in viewer is the attack vector. | — | 71% | KEV |
| masshundreds of millions of Firefox users/installs (≈10^8; Firefox held roughly double-digit desktop browser share in 2015 and the bundled PDF viewer shipped with… |
Full article461 words · extracted from securityaffairs.com · click to collapse
Mozilla released the version 39.0.3 Firefox to patch a critical 0-day vulnerability that has been exploited in the wild.
A zero-day vulnerability in Mozilla FireFox was reported on Wednesday to the company. A user noticed that an ad displayed on a Russian news website was serving an a malicious code. The exploit discovered by the user was developed to siphon sensitive files on the infected system. The exploit is very insidious, it was developed to avoid leaving traces on the targeted system.
“Yesterday morning, August 5, a Firefox user informed us that an advertisement on a news site in Russia was serving a Firefox exploit that searched for sensitive files and uploaded them to a server that appears to be in Ukraine” Mozilla wrote in a blog post.
“The vulnerability comes from the interaction of the mechanism that enforces JavaScript context separation (the ‘same origin policy’) and Firefox’s PDF Viewer”.
The flaw resides in the PDF viewer, for this reason it does not affect Firefox for Android and other Mozilla products that don’t contain the viewer component. Mozilla confirmed that the attack spotted in the wild has been targeting certain types of files hosted on Windows and Linux systems.
The experts explained that the vulnerability, coded as CVE-2015-4495,which was reported by researcher Cody Crews, cannot be exploited to execute arbitrary code.
The flaw could be exploited to inject a JavaScript payload into the local file context. In the attack uncovered by the researchers the threat actor leveraged the vulnerability to exfiltrate local files.
At the time I was writing there is no news of the attacks against Apple devices, Mozilla clarified that Mac systems could be also targeted because the payload can be adapted.
Which are the files the malware is looking for?
“On Windows the exploit looked for subversion, s3browser, and Filezilla configurations files, .purple and Psi+ account information, and site configuration files from eight different popular FTP clients. On Linux the exploit goes after the usual global configuration files like /etc/passwd, and then in all the user directories it can access it looks for.bash_history, .mysql_history, .pgsql_history, .ssh configuration files and keys, configuration files for remina, Filezilla, and Psi+, text files with “pass” and “access” in the names, and any shell scripts. ” states Mozilla.
Mozilla doesn’t exclude that the exploit was deployed also on other websites, not necessarily news website.
Firefox for both Windows and Linux users urge to change passwords and keys contained in the files targeted by the attackers.
Fortunately, ad-blocking software could allow to mitigate this kind of attacks
The vulnerability has been already patched by Mozilla that released the version 39.0.3 Firefox and Firefox ESR 38.1.1. Don’t waste time, update your version now!
(Security Affairs – zero -day, Mozilla Firefox)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/39198/cyber-crime/0-day-firefox.html