Download Firefox

Firefox is no longer supported on Windows 8.1 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox is no longer supported on macOS 10.14 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox Privacy Notice

Mozilla Foundation Security Advisory 2014-86

CSP leaks redirect data via violation reports

Announced
December 2, 2014
Reporter
Muneaki Nishimura
Impact
High
Products
Firefox, Firefox OS, SeaMonkey
Fixed in
  • Firefox 34
  • Firefox OS 2.2
  • SeaMonkey 2.31

Description

Security researcher Muneaki Nishimura discovered that Content Security Policy (CSP) violation reports triggered by a redirect did not remove path information as required by the CSP specification. This potentially reveals information about the redirect that would not otherwise be known to the original site. This could be used by a malicious site to obtain sensitive information such as usernames or single-sign-on tokens encoded within the target URLs.

This issue did not affect versions prior to Firefox 33.

References