Mozilla Foundation Security Advisory 2009-05
XMLHttpRequest allows reading HTTPOnly cookies
- Announced
- February 3, 2009
- Reporter
- Wladimir Palant
- Impact
- Low
- Products
- Firefox, SeaMonkey
- Fixed in
-
- Firefox 3.0.6
- SeaMonkey 1.1.15
Description
Developer and Mozilla community member Wladimir Palant
reported that cookies marked HTTPOnly were readable by JavaScript via
the XMLHttpRequest.getResponseHeader and
XMLHttpRequest.getAllResponseHeaders APIs. This vulnerability
bypasses the security mechanism provided by the HTTPOnly flag which
intends to restrict JavaScript access to document.cookie.
The fix prevents the XMLHttpRequest feature from accessing the
Set-Cookie and Set-Cookie2 headers of any response
whether or not the HTTPOnly flag was set for those cookies.