CVE-2020-15677: 
NixOS vulnerability analysis and mitigation

CVE-2020-15677 is a download origin spoofing vulnerability discovered in Firefox browsers and Thunderbird email clients. The vulnerability was reported by Richard Thomas and Tom Chothia of the University of Birmingham and was disclosed on September 22, 2020. It affects Firefox versions < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. By exploiting an Open Redirect vulnerability on a website, an attacker could spoof the site displayed in the download file dialog to show the original site rather than the actual download source (Mozilla Advisory).

The vulnerability occurs when handling HTTP POST requests with redirects. When a user submits a POST request to a trusted site that redirects to a download, Firefox displays the trusted site as the download source in the Downloads List panel instead of the actual download host. This behavior differs from GET requests, where the true download source is correctly displayed. The issue is related to how Firefox handles referrer information in download records, particularly in cases involving POST requests and redirects (Mozilla Bug).

The vulnerability allows attackers to obscure the true origin of downloaded files, potentially leading users to execute malicious files from untrusted sources believing they came from trusted sites. On macOS, this can affect Gatekeeper's display of the download source, further compromising the system's security measures (Ubuntu Security).

The vulnerability requires an attacker to exploit an existing Open Redirect vulnerability on a trusted website and user interaction to initiate the download. While this limits the scope of exploitation, it could be particularly effective in targeted attacks where users trust specific websites (Mozilla Advisory).

The vulnerability was fixed in Firefox 81, Thunderbird 78.3, and Firefox ESR 78.3. Users should upgrade to these versions or later to mitigate the risk. The fix ensures proper display of download sources in the browser's download interface (Debian Security).