MediumPublic exploit

Privilege Escalation via resource: URL in Firefox and Thunderbird

IdentifiersCVE-2015-0816CWE-264

A vulnerability in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allows remote attackers to execute arbitrary JavaScript code with chrome privileges. The issue arises from improper restriction of resource: URLs, enabling attackers to bypass the Same Origin Policy. This can be exploited, for example, via the resource: URL associated with PDF.js.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows remote attackers to execute arbitrary JavaScript code with chrome privileges, effectively granting them full control over the browser or mail client process. This can lead to complete compromise of the affected user's system, including access to sensitive data and the ability to install further malware.

Mitigation

If you can’t patch tonight, do this now.

As a temporary mitigation, users can disable JavaScript or restrict access to resource: URLs via browser configuration settings. Additionally, limiting the use of PDF.js or other extensions that utilize resource: URLs may reduce exposure until the software is updated.

Remediation

Patch, then assume compromise.

Upgrade to Firefox 37.0 or later, Firefox ESR 31.6 or later, and Thunderbird 31.6 or later, where the handling of resource: URLs has been corrected to enforce proper Same Origin Policy restrictions.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

firefox_pdfjs_privilege_escalation.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit module: 'firefox_pdfjs_privilege_escalation.rb', which exploits a privilege escalation vulnerability in Mozilla Firefox versions 35 and 36. The exploit leverages flaws in the handling of resource:// and chrome:// URIs in conjunction with PDF.js, allowing for privileged JavaScript injection. The module sets up a malicious web server that serves a crafted HTML/JavaScript payload. When a user with a vulnerable Firefox version visits the page and clicks anywhere, the exploit is triggered, resulting in remote code execution with the privileges of the browser process. The module supports customizable Metasploit payloads, enabling a range of post-exploitation actions. The code references two CVEs (CVE-2015-0816 and CVE-2015-0802) and targets Firefox on multiple platforms. The main attack vector is via the browser, specifically through user interaction with a malicious web page. Notable fingerprintable endpoints include the resource:// and chrome:// URI schemes and the use of data:application/pdf, to invoke PDF.js. The repository is operational and suitable for real-world exploitation in penetration testing scenarios.

Disclosed Mar 31, 2015rubyjavascriptbrowser

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

MozillaFirefoxapplication

MozillaFirefox Esrapplication

MozillaThunderbirdapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity