CVE-2008-1240 Server-side request forgery in n/a

Medium 5.0 Published 28 Mar 2008 Updated 7 Aug 2024

Remote attackers can access arbitrary local ports via improper jar URI parsing in Firefox, requiring user interaction to visit a malicious site.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2008-1240?

CVE-2008-1240 is a medium-severity server-side request forgery vulnerability in Mozilla Firefox, published on 28 Mar 2008. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

LiveConnect in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 does not properly parse the content origin for jar: URIs before sending them to the Java plugin, which allows remote attackers to access arbitrary ports on the local machine. NOTE: this is closely related to CVE-2008-1195.

Which versions are affected by CVE-2008-1240?

It affects 2 products.

Products include Mozilla Firefox, Mozilla Seamonkey.

How do I fix CVE-2008-1240?

Upgrade to a fixed version.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2008-1240 being exploited?

There is no known exploitation of CVE-2008-1240 in the wild and no public exploit code.

All Mozilla Firefox vulnerabilities

Sources

Also known as GHSA-8mpj-g6c5-r6j3.