CVE-2009-2472

Vulnerability

Mozilla Firefox before version 3.0.12 does not always use XPCCrossOriginWrapper (XOW) when constructing objects, specifically when accessing a numeric property of a window that is a subframe ([2]). The error occurs in nsWindowSH::GetProperty, which fails to call nsXPConnect::GetXOWForObject for numeric window properties ([2]). This issue is also triggered when accessing a window via this, __parent__, or valueOf.call(), leading to insufficient XOW wrapping ([4]). These flaws allow bypass of the Same Origin Policy (SOP) and are related to a 'cross origin wrapper bypass' ([1], [2], [4]).

Exploitation

An attacker can exploit this vulnerability by hosting a crafted HTML document that references a cross-origin subframe using a numeric property, or by using properties like this or valueOf.call() to access another window without proper XOW wrapping ([2], [4]). The attacker does not require authentication beyond delivering the malicious document to a victim user; the user simply needs to visit the attacker's page in a vulnerable Firefox version. Successful exploitation requires no special privileges or user interaction beyond normal browsing ([1]).

Impact

A successful attack allows the attacker to bypass the Same Origin Policy, enabling cross-site scripting (XSS) attacks ([1]). The attacker can read or modify data in other origins, such as extracting cookies, page content, or performing actions on behalf of the user on other sites ([1]). The impact is high as it compromises the confidentiality and integrity of user data across different web origins ([1], [4]).

Mitigation

The vulnerability is fixed in Mozilla Firefox 3.0.12 and later versions ([1]). Users should upgrade to Firefox 3.0.12 or higher. Red Hat Enterprise Linux 3, 4, and 5 received updates via RHSA-2009:1162 on 2009-07-22 ([1]). No workarounds are documented for users unable to upgrade. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog.