CVE-2021-23999: 
NixOS vulnerability analysis and mitigation

CVE-2021-23999 is a security vulnerability discovered in Mozilla Firefox and Thunderbird that was disclosed on April 19, 2021. The vulnerability affects Firefox ESR 78.10, Firefox 88, and Thunderbird 78.10. This moderate severity issue involves Blob URLs potentially being granted additional privileges that should not be granted to web content (Mozilla Advisory).

The vulnerability stems from a principal confusion issue where if a Blob URL was loaded through unusual user interaction, it could be loaded by the System Principal and granted additional privileges that should not be granted to web content. The issue occurred due to incorrect principal handling in the ContentParent::TransmitBlobURLsForPrincipal function, where the wrong principal was included in the BlobURLRegistrationData sent to the content process (Mozilla Bug).

If exploited, this vulnerability could allow a malicious webpage to gain elevated privileges through the System Principal, potentially leading to unauthorized access to browser functionality that should be restricted from web content. The impact was rated as moderate by Mozilla, as exploitation required specific user interaction and complex conditions to be met (Mozilla Advisory).

The vulnerability requires tricky exploitation conditions to achieve full system-principal permissions. The user must load the URL in a different process than the original page, and the triggering principal must be the system principal, which typically requires direct user intervention such as pasting the blob URL into the address bar (Mozilla Bug).

The vulnerability was fixed in Firefox 88, Firefox ESR 78.10, and Thunderbird 78.10. The fix involved correcting the principal handling in the ContentParent::TransmitBlobURLsForPrincipal function to ensure Blob URLs are created with the correct principal (Red Hat Advisory).