CVEs-PoC/2014/CVE-2014-8639.md

CVE-2014-8639

Description

Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 do not properly interpret Set-Cookie headers within responses that have a 407 (aka Proxy Authentication Required) status code, which allows remote HTTP proxy servers to conduct session fixation attacks by providing a cookie name that corresponds to the session cookie of the origin server.

POC

Reference

• http://linux.oracle.com/errata/ELSA-2015-0046.html
• http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html

Github

No PoCs found on GitHub currently.