CVE-2009-3012

Vulnerability

Mozilla Firefox versions 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre do not properly block data: URIs in HTTP Location headers when performing redirects. This allows an attacker to inject arbitrary JavaScript by crafting a Location header that points to a data:text/html URI containing malicious script [1], [2]. The vulnerability requires the server or a client-side redirect to include a Location header with a data: URI.

Exploitation

An attacker can exploit this by finding a website that uses a redirector (e.g., through a parameter in a URL that becomes part of the Location header) and injecting a data:text/html URI with JavaScript payloads. For example, when a victim visits a crafted link like http://site/redirect?url=data:text/html,, the server returns a Location header with the data: URI, and Firefox executes the script in the context of the data: origin [1]. No user interaction beyond clicking the link is required.

Impact

Successful exploitation allows arbitrary JavaScript execution, but notably the script runs in the context of the data: URI origin, not the originating website. This limits attacks like cookie theft from the target site, but still enables phishing, content spoofing, and other XSS attacks that do not rely on same-origin access [1]. The attacker can execute any JavaScript code, perform actions within the data: page, and potentially escalate through combined vulnerabilities.

Mitigation

No official fix is mentioned in the available references. Users should upgrade to a later version of Firefox (e.g., 3.5.x later than 3.5.4 or 3.6.x) where this issue is patched. Until then, avoid visiting untrusted links that trigger redirects, or disable JavaScript for data: URIs if possible.