Mozilla Foundation Security Advisory 2015-127
CORS preflight is bypassed when non-standard Content-Type headers are received
- Announced
- November 3, 2015
- Reporter
- Shinto K Anto
- Impact
- High
- Products
- Firefox, Firefox ESR, Firefox OS, Thunderbird
- Fixed in
-
- Firefox 42
- Firefox ESR 38.4
- Firefox OS 2.5
- Thunderbird 38.4
Description
Security researcher Shinto K Anto reported an issue with cross-origin
resource sharing (CORS) "preflight" requests when receiving certain
Content-Type headers. This is due to an error in implementation resulting in
trying to process multiple media types when they are returned in the
Content-Type headers from a server. This is disallowed in the CORS specification and results in a simple instead of a
"preflight" request, leading to potential same-origin policy violation.
In general this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled, but is potentially a risk in browser or browser-like contexts.