cve/2018/CVE-2018-12364.md

### [CVE-2018-12364](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12364)
![](https://img.shields.io/static/v1?label=Product&message=Firefox%20ESR&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Firefox&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Thunderbird&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3C%2060%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=%3C%2060.1%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=%3C%2061%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CSRF%20attacks%20through%20307%20redirects%20and%20NPAPI%20plugins&color=brighgreen)

### Description

NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 redirect to the target site. This allows for a malicious site to engage in cross-site request forgery (CSRF) attacks. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

### POC

#### Reference
- https://usn.ubuntu.com/3714-1/
- https://usn.ubuntu.com/3714-1/

#### Github
- https://github.com/jeetgit/json_csrf
- https://github.com/mobx26/test