Cloudanix VulnDB

CVE-2015-7184

None

CVSS

—

EPSS

1.7%

Published

Oct 18, 2015

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A problem in how the browser handled requests between different websites could let attackers secretly read private information belonging to other sites.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Data Exposure
Component
Application
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The fetch API in Firefox fails to enforce Same Origin Policy restrictions on HTTP response bodies when user credentials are supplied during improperly handled CORS requests, allowing cross-origin data access.

Why it matters to the business

Attackers can steal sensitive cross-domain data such as authentication tokens or private information, increasing risk of account takeover and data breaches; the issue affects legacy deployments still running vulnerable browser versions despite the 2015 disclosure.

How an attack unfolds

An attacker hosts a malicious site that issues a credentialed cross-origin fetch request to a target domain; due to the CORS handling flaw the browser returns the full response body, enabling the attacker to read and exfiltrate protected content without user interaction beyond visiting the crafted page.

How to fix it

Upgrade affected Firefox installations to version 41.0.2 or later; for listed qemu packages apply the specified fixes (Debian 11/12/13: 1:2.5+dfsg-1; Ubuntu 14.04 LTS: 2.0.0+dfsg-2ubuntu1.22) and verify no unsupported browser or qemu instances remain in the environment.

How to confirm the fix worked

Confirm browser and package versions match or exceed the listed fixed releases; test that cross-origin fetch requests with credentials now correctly enforce CORS preflight and block unauthorized response body access.

Typical attack path

  1. Host a malicious website under attacker control
  2. Trigger a credentialed cross-origin fetch request to the victim domain
  3. Exploit improper CORS enforcement to receive the full response body
  4. Parse and exfiltrate sensitive data such as session tokens or private content

How to detect it

Review web proxy, browser, and endpoint logs for unexpected cross-origin fetch activity originating from untrusted domains; search historical browser process execution and update records for versions prior to the fixed releases.

What your security team should do

  • Immediately inventory all endpoints for the vulnerable Firefox and qemu versions and prioritize upgrades
  • Block legacy browser usage via enterprise policy where feasible
  • Monitor for any remaining instances given the multi-year exposure window

The record

The fetch API implementation in Mozilla Firefox before 41.0.2 does not restrict access to the HTTP response body in certain situations where user credentials are supplied but the CORS cross-origin request algorithm is improperly followed, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:14.04:LTS firefox 0 41.0.2+build2-0ubuntu0.14.04.1
openSUSE:Tumbleweed MozillaFirefox 0 50.1.0-1.1
openSUSE:Tumbleweed firefox-esr 0 128.5.1-1.1

Related vulnerabilities