CVE-2021-23968: 
NixOS vulnerability analysis and mitigation

CVE-2021-23968 is a security vulnerability discovered in Firefox versions prior to 86, Thunderbird versions prior to 78.8, and Firefox ESR versions prior to 78.8. The vulnerability was reported by Ademar Nowasky Junior and disclosed on February 23, 2021. The issue affects the Content Security Policy (CSP) violation reporting mechanism in Mozilla's browser products (Mozilla Advisory).

The vulnerability occurs when Content Security Policy blocks frame navigation. In such cases, the full destination URL of a redirect served in the frame was incorrectly reported in the CSP violation report, instead of only including the original frame URI. This behavior deviates from the W3C Content Security Policy specification which requires that only pre-redirect URLs or stripped-down origins should be included in violation reports (Mozilla Advisory).

This vulnerability could be exploited to leak sensitive information contained in redirect URIs, such as usernames, single-sign-on tokens, or other confidential data that might be embedded in URLs. The vulnerability is rated as high impact due to its potential for information disclosure (Ubuntu Security).

The vulnerability can be exploited by a malicious website that serves content with specific Content Security Policy settings and attempts to iframe a page that performs redirects containing sensitive information. A proof-of-concept demonstrated the ability to leak OAuth authorization codes and access tokens through this method (Mozilla Advisory).

The vulnerability was fixed in Firefox 86, Thunderbird 78.8, and Firefox ESR 78.8. Users should upgrade to these versions or later to mitigate the risk. The fix ensures that only the original frame URI is reported in CSP violation reports, rather than the full redirect destination URL (Mozilla Advisory).