CVE-2023-25728

What it actually does

The Content-Security-Policy-Report-Only header could allow an attacker to leak a child iframe's unredacted URI when interaction with that iframe triggers a redirect.

Why it matters to the business

Attackers may obtain sensitive URI data from embedded frames in affected applications, increasing risk of information exposure across widely used browser and geonode deployments with no ransomware usage reported.

How an attack unfolds

An attacker loads a malicious page containing a child iframe, induces a redirect within the iframe, and leverages the report-only CSP header to capture the full unredacted URI in the resulting report.

How to fix it

Upgrade geonode/geonode (GIT) to commit a9eebae80cb362009660a1fd49e105e7cdb499b9; apply equivalent patches for Firefox >= 110, Thunderbird >= 102.8, and Firefox ESR >= 102.8.

How to confirm the fix worked

Confirm the updated commit or browser version is deployed, then test CSP report-only behavior with redirecting iframes to verify URIs are no longer leaked in reports.

Typical attack path

1. Serve a page embedding a target iframe
2. Trigger navigation or redirect inside the iframe via user interaction or script
3. Inspect CSP violation reports to extract the leaked URI

How to detect it

Review web server or browser logs for unexpected CSP report-only entries containing full URIs from iframes; no specific threat actor campaigns are associated with this issue.

What your security team should do

• Prioritize upgrade of all geonode instances and Mozilla products to the listed fixed versions within standard change windows
• Review CSP report handling code for any reliance on unredacted URIs
• Monitor for increased CSP report volume as a potential indicator of probing