Cloudanix VulnDB

CVE-2023-34415

Medium · 6.1

CVSS

6.1

EPSS

0.4%

Published

Jun 19, 2023

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

Older versions of Firefox could let attackers read private information from other websites if those sites allowed certain kinds of redirects.

Chainable
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Data Exposure
Component
Application
Class
Open Redirect
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Bypasses site-isolation protections by loading a data: URL document (resulting from an HTTP redirect) in the same process as the redirecting site, enabling Spectre-like side-channel attacks against sites hosting open redirects.

Why it matters to the business

Attackers could leak sensitive cross-site data from organizations whose sites permit open redirects, increasing risk of information disclosure without requiring code execution or user interaction beyond visiting a link.

How an attack unfolds

An attacker identifies or compromises a site with an open redirect, crafts a link that redirects to a malicious data: URL payload, and tricks a victim into visiting it; Firefox versions prior to 114 load the data: document in the original site's process, allowing Spectre side-channel reads of cross-origin memory.

How to fix it

Upgrade Mozilla Firefox to version 114 or later, which stops following HTTP redirects to data: URLs and restores proper site isolation.

How to confirm the fix worked

Confirm installed Firefox version is 114 or newer; attempt an HTTP redirect to a data: URL and verify it is blocked or isolated to a separate process.

Typical attack path

  1. Locate or set up a site that performs open HTTP redirects
  2. Craft a redirect chain ending in a data: URL containing Spectre gadget code
  3. Deliver the link via phishing or malicious page
  4. Victim browser loads the data: document in the redirect origin's process
  5. Perform Spectre side-channel attack to read cross-site data

How to detect it

Inspect browser process logs, network traces, and crash reports for data: URLs appearing immediately after cross-origin redirects; correlate with memory access patterns indicative of Spectre probing.

What your security team should do

  • Deploy Firefox 114+ to all endpoints immediately given the open-redirect bypass nature
  • Audit internal and partner sites for open redirect functionality and remediate where possible
  • Block or monitor outbound redirects to data: URLs at proxy or endpoint level

The record

When choosing a site-isolated process for a document loaded from a data: URL that was the result of a redirect, Firefox would load that document in the same process as the site that issued the redirect. This bypassed the site-isolation protections against Spectre-like attacks on sites that host an "open redirect". Firefox no longer follows HTTP redirects to data: URLs. This vulnerability affects Firefox < 114.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:20.04:LTS firefox 0 114.0+build3-0ubuntu0.20.04.1
openSUSE:Tumbleweed MozillaFirefox 0 114.0.1-1.1
openSUSE:Tumbleweed firefox-esr 0 128.5.1-1.1

Related vulnerabilities