Firefox New Tab Page Bookmarklet Privileged JS Execution (CVE-2012-4203)

Key Information Bug Number: 765628 (CVE-2012-4203) Summary: Bookmarklets on the new tab page are able to run privileged javascript Status: Closed, RESOLVED FIXED Severity: normal Product: Firefox Component: General Version: 13 Branch Fixed In: Firefox 17 Annotations - - - Main Description Issue Description: When clicking on a link containing a URI from the new tab page, the script runs with privileged privileges. URIs are commonly used as bookmarklets to execute small JavaScript snippets. If a malicious third party exploits this feature via social engineering, they could trick users into adding a script bookmarklet to the new Firefox 13 "New Tab Page". When the user clicks on this link, privileged JavaScript will execute. Example Impact Sample code demonstrates how to run the tool in privileged mode on Ubuntu. Tested only on 32-bit Ubuntu with Firefox 13. Mitigation Approach On Windows, the script could attempt to run to demonstrate the social engineering potential. Adding the script as a bookmark and launching it from the new tab page allows execution of native applications. Attempts were made to adapt the path for OS X systems, but the issue could not be successfully triggered. Patches and Discussion Users such as Tim Taubert and Gavin Sharp submitted related patches (e.g., patch v1) and code changes, discussing the use of to control external drag-and-drop, and the implementation of links on the new tab page. Some discussions focused on whether the new tab page should be designed as a non-privileged page, while enabling communication with scripts via messaging mechanisms to allow inclusion of privileged script links. Gabrielsk mentioned code review and fixing the Drag&Drop issue to the new tab page, but ultimately the review was completed. Tracking Status Tracking flags: Not affected in Firefox 15, 16; affected in Firefox 17; not fixed in Firefox 10, esr10. The vulnerability was fixed in Firefox 17.

Goal Reached Thanks to every supporter — we hit 100%!

Firefox New Tab Page Bookmarklet Privileged JS Execution (CVE-2012-4203)