Cloudanix VulnDB

CVE-2021-43532

Medium · 6.1

CVSS

6.1

EPSS

0.5%

Published

Dec 8, 2021

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A browser feature that copies image links could accidentally include secret login tokens, letting attackers steal accounts if users paste those links back into malicious pages.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Moderate
Impact
Data Exposure
Component
Application
Class
Open Redirect
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The 'Copy Image Link' action returns the final redirected image URL instead of the original, allowing an attacker-controlled image with embedded auth flows (combined with CSP interrupting the redirect chain) to expose authentication tokens in the copied URL.

Why it matters to the business

Attackers can potentially steal user authentication tokens leading to account takeover on affected sites if users are tricked into pasting the copied link, increasing risk of unauthorized access across user accounts.

How an attack unfolds

An attacker hosts an image that initiates an authentication redirect flow, applies a CSP that halts the redirect chain midway to surface a token-bearing final URL, tricks the victim into using Copy Image Link and pasting the result back into the malicious page, which then exfiltrates the token for account takeover.

How to fix it

Upgrade Mozilla Firefox to version 94 or later where the Copy Image Link action is changed to always return the original pre-redirect URL.

How to confirm the fix worked

Verify Firefox version is 94 or newer; test the Copy Image Link action on a redirecting image to confirm the original URL (not the final redirected one) is copied.

Typical attack path

  1. Craft a page embedding an image that triggers an authentication redirect chain
  2. Apply Content Security Policy to interrupt the redirect and expose a token-containing final URL
  3. Social-engineer the victim into right-clicking the image and selecting Copy Image Link
  4. Trick the victim into pasting the copied URL back into the attacker-controlled page
  5. Exfiltrate the authentication token from the pasted URL to hijack the victim's account

How to detect it

Review browser history and clipboard-related logs for unexpected copy-paste activity involving image URLs from untrusted domains; inspect CSP violation reports for redirect-interrupting policies combined with image loads.

What your security team should do

  • Prioritize upgrading all Firefox instances to version 94 or later
  • Educate users on risks of pasting copied links from untrusted sources
  • Monitor for unusual authentication token usage patterns in application logs

The record

The 'Copy Image Link' context menu action would copy the final image URL after redirects. By embedding an image that triggered authentication flows - in conjunction with a Content Security Policy that stopped a redirection chain in the middle - the final image URL could be one that contained an authentication token used to takeover a user account. If a website tricked a user into copy and pasting the image link back to the page, the page would be able to steal the authentication tokens. This was fixed by making the action return the original URL, before any redirects. This vulnerability affects Firefox < 94.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:18.04:LTS firefox 0 94.0+build3-0ubuntu0.18.04.1
Ubuntu:20.04:LTS firefox 0 94.0+build3-0ubuntu0.20.04.1
Ubuntu:22.04:LTS firefox 0 94.0+build3-0ubuntu1

Related vulnerabilities