Firefox – Same-Origin Policy Bypass (CVE-2015-7188) • Hacker News Board

Firefox – Same-Origin Policy Bypass (CVE-2015-7188)

#1

Post by cujanovic » Wed, Jul 06, 2016, 10:48 AM UTC

Firefox – Same-Origin Policy Bypass (CVE-2015-7188)
blog.bentkowski.info

Re: Firefox – Same-Origin Policy Bypass (CVE-2015-7188)

#2

Post by afshinmeh » Wed, Jul 06, 2016, 4:48 PM UTC

They have fixed it, no? https://bugzilla.mozilla.org/show_bug.cgi?id=1199430

Re: Firefox – Same-Origin Policy Bypass (CVE-2015-7188)

#3

Post by softblush » Wed, Jul 06, 2016, 6:07 PM UTC

afshinmeh wrote: post #2

They have fixed it, no? https://bugzilla.mozilla.org/show_bug.cgi?id=1199430

Yes, in Firefox 42.

> However, I think that this bug is interesting from a purely technical standpoint, hence I decided to share.

Re: Firefox – Same-Origin Policy Bypass (CVE-2015-7188)

#4

Post by mnarayan01 » Wed, Jul 06, 2016, 6:09 PM UTC

Title seems misleading. The same-origin bypass is via Flash. The Firefox portion is having a funky URL/hostname, which Flash then uses (edit: mis-parses).

Re: Firefox – Same-Origin Policy Bypass (CVE-2015-7188)

#5

Post by tener » Wed, Jul 06, 2016, 7:05 PM UTC

Very interesting exploit. I wonder what else is affected by IP addresses parsing issues.

Re: Firefox – Same-Origin Policy Bypass (CVE-2015-7188)

#6

Post by cmdrfred » Wed, Jul 06, 2016, 10:30 PM UTC

softblush wrote: post #3

afshinmeh wrote: post #2

They have fixed it, no? https://bugzilla.mozilla.org/show_bug.cgi?id=1199430

Yes, in Firefox 42. > However, I think that this bug is interesting from a purely technical standpoint, hence I decided to share.

It was fascinating, and a good reason not to copy and paste code when you can prevent it.