Security Researcher Ashar Javed, recently discovered
three bugs with Mozilla add-ons portal and that had been exploited via
"Create new collection" feature.
It was discovered that malicious codes could be inserted in collection of Mozilla Add - ons . These ad - ons are basically used to organize add-ons for business and personal purposes and can be shared on social media as well.
“Given that the Mozilla add-on site has millions of downloads, it is easily possible for the attacker to convince the victim to visit the collection page,” the expert told SecurityWeek.
Users were later exposed with all kinds of virus attack that could be carried via XSS flaws and most common attack was cookie theft.
Websites are generally vulnerable to XSS flaw, add-on collections are very useful for Firefox users, so for discovering the issue Mr Javed recieved $2,500 from Mozilla. There were two other bugs discovered about which Mozilla did not reveled any information apart from the location.
This is not the first time that he had received the heavy amount, Google awarded him $3,000 for a reflected XSS in the main search bar of the YouTube Gaming website.
It was discovered that malicious codes could be inserted in collection of Mozilla Add - ons . These ad - ons are basically used to organize add-ons for business and personal purposes and can be shared on social media as well.
“Given that the Mozilla add-on site has millions of downloads, it is easily possible for the attacker to convince the victim to visit the collection page,” the expert told SecurityWeek.
Users were later exposed with all kinds of virus attack that could be carried via XSS flaws and most common attack was cookie theft.
Websites are generally vulnerable to XSS flaw, add-on collections are very useful for Firefox users, so for discovering the issue Mr Javed recieved $2,500 from Mozilla. There were two other bugs discovered about which Mozilla did not reveled any information apart from the location.
This is not the first time that he had received the heavy amount, Google awarded him $3,000 for a reflected XSS in the main search bar of the YouTube Gaming website.
Comments
Post a Comment