Download Firefox

Firefox is no longer supported on Windows 8.1 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox is no longer supported on macOS 10.14 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox Privacy Notice

Mozilla Foundation Security Advisory 2008-32

Remote site run as local file via Windows URL shortcut

Announced
July 1, 2008
Reporter
Geoff ("misterffoeg")
Impact
Moderate
Products
Firefox, SeaMonkey
Fixed in
  • Firefox 2.0.0.15
  • SeaMonkey 1.1.10

Description

Mozilla community member Geoff reported that URL shortcut files on Windows (for example, saved IE favorites) could be interpreted as if they were in the local file context when opened by Firefox, although the referenced remote content would be downloaded and displayed. Scripts loaded from the remote site would have access to all local file content in Firefox 2 if they were programmed to look for it.

Exploiting this vulnerability would involve first fooling the user into saving such a shortcut to a malicious site--typically from some other program since Firefox does not use this format--and then find the saved file on the desktop and choose to open it with Firefox.

In affected pre-release versions of Firefox 3 the vulnerability was further mitigated by the additional restrictions on file content that prevent searching the local disk in this manner. Malicious scripts could only read from files with known names stored in the same folder (or sub-folder) as the shortcut.

References