Cross-origin data disclosure via Web Workers and importScripts

Cross-origin data disclosure via Web Workers and importScripts

Announced

July 20, 2010

Reporter

Yosuke Hasegawa

Impact

High

Products

Firefox, SeaMonkey, Thunderbird

Fixed in

• Firefox 3.5.11
• Firefox 3.6.7
• SeaMonkey 2.0.6
• Thunderbird 3.0.6
• Thunderbird 3.1.1

Description

Security researcher Yosuke Hasegawa reported that the Web Worker method importScripts can read and parse resources from other domains even when the content is not valid JavaScript. This is a violation of the same-origin policy and could be used by an attacker to steal information from other sites.

References

• https://bugzilla.mozilla.org/show_bug.cgi?id=568148
• CVE-2010-1213