The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.
A browser or email client should remove the `username:password` fragment from URLs before including them in CSP reports sent to the server. In vulnerable versions, this mechanism did not work correctly, so the full URL containing authentication credentials was saved and transmitted in the CSP report content. An attacker controlling the CSP report reception point or able to intercept them could read this data.
An attacker can obtain HTTP Basic Authentication credentials (login and password) of a user, which may lead to account takeover and unauthorized access to protected resources.
Update to Firefox 141, Firefox ESR 128.13 or Firefox ESR 140.1, and Thunderbird 141, Thunderbird 128.13 or Thunderbird 140.1, in which the vulnerability has been fixed.
Mozilla Firefox before version 141 and Firefox ESR before versions 128.13 and 140.1; Mozilla Thunderbird before version 141 and Thunderbird ESR before versions 128.13 and 140.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HMozilla Firefox
APPMozilla< 128.13.0< 141.0140.0 – 140.1.0 (excl.)Mozilla Thunderbird
APPMozilla< 128.13.0< 141.0140.0 – 140.1.0 (excl.)
Related vulnerabilities
Use-after-free w Animation timelines Firefox/Thunderbird — RCE
Use-after-free w WebGPU IPC framework Mozilla — sandbox escape
Mozilla Firefox/Thunderbird: przełamanie sandbox przez IPC Prompt:Open
RCE w Mozilla Firefox przez błąd nsCSSFrameConstructor::ContentAppended
Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox...