rapid7/metasploit-framework — pull request #3172 by jvennix-r7 (2014-04-02 04:54:51+00:00)
Title: Add CVE-2014-1510 to firefox_xpi_bootstrapped_addon to bypass the first permission prompt on FF 27

This tweaks the `firefox_xpi_bootstrapped_addon` module to allow bypass of the first stage permission prompt for installing the addon on Firefox 22-27. Usually this is a 2 click exploit, this change makes it 1 click.

Also note that according to the [advisory](https://www.mozilla.org/security/announce/2014/mfsa2014-29.html), the vulnerability I am exploiting somehow allows code execution on FF 22-27 by loading a javascript URL with chrome privileges, but I have not figured out the magic required to get this to work.

#### Prompt 1

![screen shot 2014-04-01 at 11 47 40 pm](https://cloud.githubusercontent.com/assets/1184013/2587505/7387c578-ba22-11e3-8647-2d6cc0d7ef19.png)

#### Prompt 2

![screen shot 2014-04-01 at 11 47 49 pm](https://cloud.githubusercontent.com/assets/1184013/2587506/755306ba-ba22-11e3-8be9-95fdf1b507a7.png)

### Verification
- [ ] Both prompts required on firefox 21 and below, session is created when addon is installed
- [ ] You should only encounter one prompt on firefox 22-27, session is created when addon is installed
- [ ] Both prompts required on firefox 28, session is created when addon is installed