Mozilla Foundation Security Advisory 2015-04
Cookie injection through Proxy Authenticate responses
- Announced
- January 13, 2015
- Reporter
- Xiaofeng Zheng, Blue Lotus Team
- Impact
- Moderate
- Products
- Firefox, Firefox ESR, SeaMonkey, Thunderbird
- Fixed in
-
- Firefox 35
- Firefox ESR 31.4
- SeaMonkey 2.32
- Thunderbird 31.4
Description
Security researcher Xiaofeng Zheng of the Blue Lotus Team at
Tsinghua University reported reported that a Web Proxy returning a 407 Proxy
Authentication response with a Set-Cookie header could inject
cookies into the originally requested domain. This could be used for
session-fixation attacks. This attack only allows cookies to be written but does
not allow them to be read.
In general this flaw cannot be exploited through email in the Thunderbird product, but is potentially a risk in browser or browser-like contexts.