CVE-2020-12415

What it actually does

When "%2F" was present in a manifest URL, Firefox's AppCache behavior may have become confused and allowed a manifest to be served from a subdirectory. This could cause the appcache to be used to service requests for the top level directory.

Why it matters to the business

Attackers could manipulate cached content delivery for web applications, potentially leading to integrity issues in served resources without requiring user privileges beyond visiting a crafted page.

How an attack unfolds

An attacker prepares a malicious manifest URL containing encoded path traversal characters like %2F, tricks a user into visiting a page that references it, and leverages the resulting AppCache misbehavior to have the browser serve attacker-controlled content for top-level directory requests.

How to fix it

Upgrade affected Firefox installations to version 78 or later. For listed openexr packages apply the referenced fixes such as 2.5.4-1 on Debian releases or the listed GIT commits including 7bab6d44caf65ee3cabe31553f8e2968c8747be5 and 1899a456cbafb213c4a53c35eb3203296f92e503.

How to confirm the fix worked

Confirm Firefox version is at least 78; verify openexr packages match the fixed versions or commits provided for each distribution and repository.

Typical attack path

1. Craft a web page or manifest URL embedding %2F sequences targeting AppCache handling
2. Lure a victim browser into loading the manifest via social engineering or compromised site
3. Trigger AppCache confusion to serve manifest content for unintended top-level paths
4. Abuse the mis-served cache to deliver altered resources or interfere with application behavior

How to detect it

Review web server and browser logs for manifest requests containing %2F sequences; examine AppCache storage artifacts and network traces for unexpected subdirectory manifest sourcing on top-level paths.

What your security team should do

• Prioritize patching Firefox to 78+ across all endpoints due to the published date and persistent EPSS score
• Audit web applications relying on AppCache for any manifest URL handling that could be influenced by encoded slashes
• Monitor for browser updates and test AppCache-dependent sites post-upgrade
• Apply the exact openexr fixed versions listed for Debian 11/12/13 and GIT repositories