Mozilla Foundation Security Advisory 2009-69
Location bar spoofing vulnerabilities
- Announced
- December 15, 2009
- Reporter
- Jonathan Morgan, Jordi Chancel
- Impact
- Moderate
- Products
- Firefox, SeaMonkey
- Fixed in
-
- Firefox 3.0.16
- Firefox 3.5.6
- SeaMonkey 2.0.1
Description
Security researcher Jonathan Morgan reported that
when a page loaded over an insecure protocol, such as http: or file:,
sets its document.location to a https: URL which
responds with a 204 status and empty response body, the insecure page
will receive SSL indicators near the location bar, but will not have
its page content modified in any way. This could lead to a user
believing they were on a secure page when in fact they were not.
Security researcher Jordi Chancel reported an
issue similar to one fixed
in mfsa2009-44 in which a web page can
set document.location to a URL that can't be displayed
properly and then inject content into the resulting blank page. An
attacker could use this vulnerability to place a legitimate-looking
but invalid URL in the location bar and inject HTML and JavaScript
into the body of the page, resulting in a spoofing attack.