Mozilla Foundation Security Advisory 2016-74
Form input type change from password to text can store plain text password in session restore file
- Announced
- August 2, 2016
- Reporter
- Mike Kaply
- Impact
- Moderate
- Products
- Firefox
- Fixed in
-
- Firefox 48
Description
Mozilla employee Mike Kaply reported that the Firefox session restore data can contain passwords in plain text if a password input field on a page has its type changed from "password" to "text" during a session. This can occur if the password input field has a scripted mechanism to display the password to the user. Once this type is changed, the password data will persist as clear text within stored form data for this page. This could result in a potential revelation of site passwords on sites that use this mechanism to display password data if an attacker could find a way to read the session restoration file.