PatchGap
Firefox · Core

CVE-2024-9394

Cross Origin in Core
High firefox Cross Origin 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionAn attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtools` origin. This could allow them to access cross-origin JSON content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions.
ComponentCore
Bug ClassCross Origin
Tracker1918874
Fix commite5a95be806bd (firefox) +7/-1
CISA KEVNot listed
CreditedMasato Kinugawa
Disclosed2024-10-01

Changed Functions

FunctionChangeNotes
asyncConvertData
devtools/client/jsonview/converter-child.js
 modified
getConvertedType
devtools/client/jsonview/converter-child.js
 modified
if
devtools/client/jsonview/converter-child.js
 modified

Files Changed

  • devtools/client/jsonview/converter-child.js

Patch

view commit
diff --git a/devtools/client/jsonview/converter-child.js b/devtools/client/jsonview/converter-child.js
index e249de01802..3c8c9fcc5dc 100644
--- a/devtools/client/jsonview/converter-child.js
+++ b/devtools/client/jsonview/converter-child.js
@@ -72,7 +72,13 @@ Converter.prototype = {
   asyncConvertData(fromType, toType, listener) {
     this.listener = listener;
   },
-  getConvertedType() {
+  getConvertedType(_fromType, channel) {
+    if (channel instanceof Ci.nsIMultiPartChannel) {
+      throw new Components.Exception(
+        "JSONViewer doesn't support multipart responses.",
+        Cr.NS_ERROR_FAILURE
+      );
+    }
     return "text/html";
   },
Loading diff…
On This Page