CVE-2008-4066

Vulnerability

This vulnerability resides in the cross-site scripting (XSS) protection mechanism of Mozilla Firefox versions 2.0.0.14 through 2.0.0.16. The HTML parser ignores low surrogate characters when they are HTML-escaped, allowing attackers to craft sequences such as "jav&#56325ascript" that bypass the filter but are still interpreted as valid script by the browser. [4]

Exploitation

An attacker can exploit this by embedding HTML-escaped low surrogate characters into a malicious URI or web page to conceal script keywords from the XSS filter. The victim must visit the crafted page or click a link; no additional authentication or privileges are required.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's session on the target domain, potentially leading to data theft, session hijacking, or further malicious actions.

Mitigation

Mozilla fixed this issue in Firefox 2.0.0.17, released on September 23, 2008. Users should upgrade to Firefox 2.0.0.17 or later. The Slackware security advisory also confirms the fix in Thunderbird 2.0.0.17, which shares the same underlying code. [4]