CVE-2013-1727
Firefox < 24.0 - Same Origin Policy Bypass and Cross-Site Scripting via Symlink and file: URL
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2013-1727. PoCs published by Takeshi Terada.
AI-analyzed exploit summary This exploit leverages a same-origin policy bypass in Mozilla Firefox (CVE-2013-1727) by creating a malicious HTML file, forcing Firefox to load it, and then replacing it with a symbolic link to steal sensitive data (profiles.ini). The attack relies on Android's file system manipulation and intent-based app invocation.
Description
Mozilla Firefox before 24.0 on Android allows attackers to bypass the Same Origin Policy, and consequently conduct cross-site scripting (XSS) attacks or obtain password or cookie information, by using a symlink in conjunction with a file: URL for a local file.
Exploits (1)
This exploit leverages a same-origin policy bypass in Mozilla Firefox (CVE-2013-1727) by creating a malicious HTML file, forcing Firefox to load it, and then replacing it with a symbolic link to steal sensitive data (profiles.ini). The attack relies on Android's file system manipulation and intent-based app invocation.