module

Firefox 17.0.1 Flash Privileged Code Injection

Try Surface Command
Back to search
Disclosed
2013-01-08
Created
2018-05-30

Description

This exploit gains remote code execution on Firefox 17 and 17.0.1, provided
the user has installed Flash. No memory corruption is used.

First, a Flash object is cloned into the anonymous content of the SVG
"use" element in the (CVE-2013-0758). From there, the Flash object
can navigate a child frame to a URL in the chrome:// scheme.

Then a separate exploit (CVE-2013-0757) is used to bypass the security wrapper
around the child frame's window reference and inject code into the chrome://
context. Once we have injection into the chrome execution context, we can write
the payload to disk, chmod it (if posix), and then execute.

Note: Flash is used here to trigger the exploit but any Firefox plugin
with script access should be able to trigger it.

Authors

Marius Mlynski
joev [email protected]
sinn3r [email protected]

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:


    msf > use exploit/multi/browser/firefox_svg_plugin
    msf exploit(firefox_svg_plugin) > show targets
        ...targets...
    msf exploit(firefox_svg_plugin) > set TARGET < target-id >
    msf exploit(firefox_svg_plugin) > show options
        ...show and set options...
    msf exploit(firefox_svg_plugin) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today