XMLHttpRequest inherits incorrect principal within sandbox

XMLHttpRequest inherits incorrect principal within sandbox

Announced

November 20, 2012

Reporter

Gabor Krizsanits

Impact

High

Products

Firefox, SeaMonkey, Thunderbird

Fixed in

• Firefox 17
• SeaMonkey 2.14
• Thunderbird 17

Description

Mozilla developer Gabor Krizsanits discovered that XMLHttpRequest objects created within sandboxes have the system principal instead of the sandbox principal. This can lead to cross-site request forgery (CSRF) or information theft via an add-on running untrusted code in a sandbox.

References

• XHR created from sandboxes end up having system principal instead of principal of the sandbox
• CVE-2012-4205