CVE-2018-12364 : Exploit Details and Defense Strategies

CVE-2018-12364 was published on October 18, 2018, affecting various Mozilla products like Thunderbird, Firefox ESR, and Firefox. The vulnerability allows for cross-site request forgery (CSRF) attacks through 307 redirects and NPAPI plugins.

Understanding CVE-2018-12364

This CVE impacts multiple versions of Thunderbird, Firefox ESR, and Firefox due to a specific vulnerability related to NPAPI plugins.

What is CVE-2018-12364?

NPAPI plugins, such as Adobe Flash, can exploit a vulnerability that enables malicious websites to conduct CSRF attacks through 307 redirects.

The Impact of CVE-2018-12364

The vulnerability affects Thunderbird versions prior to 60 and 52.9, Firefox ESR versions prior to 60.1 and 52.9, and Firefox versions prior to 61.

Technical Details of CVE-2018-12364

This section provides more in-depth technical insights into the vulnerability.

Vulnerability Description

The vulnerability allows NPAPI plugins to send non-simple cross-origin requests, bypassing CORS through a same-origin POST with a 307 redirect, facilitating CSRF attacks.

Affected Systems and Versions

Thunderbird versions prior to 60 and 52.9
Firefox ESR versions prior to 60.1 and 52.9
Firefox versions prior to 61

Exploitation Mechanism

Malicious websites exploit the vulnerability by using NPAPI plugins to perform CSRF attacks through 307 redirects.

Mitigation and Prevention

To address CVE-2018-12364, follow these mitigation strategies:

Immediate Steps to Take

Update affected products to the latest versions
Disable NPAPI plugins if possible

Long-Term Security Practices

Regularly monitor security advisories from Mozilla
Implement strict cross-origin policies to prevent CSRF attacks

Patching and Updates

Apply security patches provided by Mozilla