CVE-2021-23972: 
NixOS vulnerability analysis and mitigation

CVE-2021-23972 is a security vulnerability discovered in Firefox versions prior to 86 that involves HTTP Auth phishing warning bypass. The vulnerability was discovered by Vijay Tikudave and disclosed in February 2021. The issue affects Firefox's security feature that warns users about potential phishing attempts using HTTP Auth in URLs (Mozilla Advisory, NVD).

The vulnerability occurs when a malicious URL containing HTTP Auth credentials is accessed (e.g., 'https://www.phishingtarget.com@evil.com'). Firefox normally displays a warning dialog to protect users from this phishing tactic. However, if the evil.com domain uses a redirect that is cached by the browser, the warning dialog would not be displayed, effectively bypassing this security measure. The issue was assigned a CVSS 3.1 base score of 8.8 (High) (Ubuntu CVE).

The vulnerability could allow attackers to conduct phishing attacks by bypassing Firefox's built-in security warning system. This could lead to users being redirected to malicious websites without receiving the intended security warning, potentially exposing them to credential theft and other phishing-related attacks (Mozilla Advisory).

The vulnerability requires user interaction and can be exploited by creating a specially crafted URL that includes HTTP Auth credentials followed by a malicious domain that implements cached redirects. The attack vector is through the network, with low attack complexity (Ubuntu CVE).

The vulnerability was fixed in Firefox version 86. Users should upgrade to Firefox 86 or later to receive the security fix. The fix involves ensuring that the HTTP Auth warning prompt is displayed even when the response comes from the browser cache (Mozilla Bug).