PT-2014-2021 · Mozilla+2 · Firefox+2
Muneaki Nishimura
·
Publicado
2014-09-28
·
Atualizado
2024-12-12
·
CVE-2017-7788
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Mozilla Firefox versions prior to 55
Description
The issue is related to a security policy inheritance error. It may allow a remote attacker to bypass security restrictions. Specifically, when an "iframe" has a "sandbox" attribute and its content is specified using "srcdoc", that content does not inherit the containing page's Content Security Policy (CSP) as it should unless the sandbox attribute included "allow-same-origin".
Recommendations
For versions prior to 55, update to version 55 or later to resolve the issue. As a temporary workaround, consider including "allow-same-origin" in the sandbox attribute of iframes to ensure proper CSP inheritance. Restrict access to iframes with the sandbox attribute and srcdoc content to minimize the risk of exploitation.
Exploit
Correção
Special Elements Injection
Incorrect Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Firefox
Ubuntu