CVE-2013-1690
HIGH KEVFirefox < 22.0 and Thunderbird < 17.0.7 - Remote Code Execution via onreadystatechange Event Handling
Title source: llmExploitation Summary
CVE-2013-1690 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 28, 2022.
EIP tracks 3 public exploits from researchers including Metasploit, vlad902, Nils, Unknown, w3bd3vil, sinn3r, juan vazquez, including a Metasploit module exploits/windows/browser/mozilla_firefox_onreadystatechange.
AI-analyzed exploit summary This Metasploit module exploits a use-after-free vulnerability in Firefox 17.0.6 via a crafted webpage using onreadystatechange events and window.stop(). It achieves RCE through heap spraying and ROP chains on Windows XP SP3.
Description
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.
Exploits (3)
This Metasploit module exploits a use-after-free vulnerability in Firefox 17.0.6 via a crafted webpage using onreadystatechange events and window.stop(). It achieves RCE through heap spraying and ROP chains on Windows XP SP3.
This is a working exploit PoC for CVE-2013-1690, targeting a memory corruption vulnerability in Firefox's JavaScript engine. The exploit manipulates array buffers and sparse arrays to achieve arbitrary memory read/write, leading to remote code execution.
This Metasploit module exploits a use-after-free vulnerability in Firefox 17.0.6 and 21 via a crafted HTML page using onreadystatechange events and window.stop(). It achieves remote code execution by spraying the heap with shellcode and manipulating the DocumentViewerImpl object.
References (18)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H