CVE-2005-1477

An attacker must first identify a site on Firefox's software installation whitelist (e.g., update.mozilla.org or addon.mozilla.org) that is vulnerable to cross-site scripting (XSS). The attacker then uses that XSS flaw to inject a crafted InstallTrigger call that specifies a javascript: URL as the package icon. Because InstallTrigger URLs are granted chrome privileges, the javascript: URL executes arbitrary code with elevated rights, bypassing the normal sandbox restrictions [ref_id=1].

The vulnerability resides in the InstallTrigger mechanism in Firefox 1.0.3. The bug allows URLs passed to InstallTrigger functions (such as the package icon URL) to execute with chrome privileges, meaning they run in a privileged context rather than the originating web page's security context [ref_id=1].

The advisory does not include a patch diff, but the resolution in the bug tracker indicates the issue was addressed by ensuring InstallTrigger URLs no longer receive chrome privileges. The workaround documented is to disable "Allow web sites to install software" in Tools > Options > Web Features [ref_id=1]. The fix prevents javascript: URLs and other privileged schemes from executing in the chrome context when passed through InstallTrigger.

The PoC references at http://greyhatsecurity.org/firefox.htm and http://greyhatsecurity.org/vulntests/ffrc.htm demonstrate the exploit, but their exact contents are not included in the bundle. The bug report [ref_id=1] references an attachment titled "Proof of Concept (from frsirt.com)" but the attachment content is not provided in this bundle.