CVE-2025-8031: 
NixOS vulnerability analysis and mitigation

CVE-2025-8031 is an incorrect URL stripping vulnerability in Mozilla Firefox and Thunderbird where the username:password portion of URLs was not properly removed before inclusion in Content Security Policy (CSP) violation reports, potentially leaking HTTP Basic Authentication credentials to CSP report endpoints. Discovered and reported internally by Mozilla engineer Tom Schuster, the vulnerability was publicly disclosed on July 22, 2025. Affected versions include Firefox before 141, Firefox ESR before 128.13, Firefox ESR before 140.1, Thunderbird before 141, Thunderbird ESR before 128.13, and Thunderbird ESR before 140.1. Mozilla rated this vulnerability as moderate impact, while Feedly's CVSS v3.1 estimate assigns a base score of 9.8 (Critical) — though the official Mozilla advisory classifies it as moderate severity (Mozilla MFSA2025-56, Mozilla MFSA2025-58, Mozilla MFSA2025-59).

The root cause is a non-conformant implementation of the W3C CSP specification's "Strip URL for use in reports" algorithm (Section 5.4), classified under CWE-276 (Incorrect Default Permissions). Firefox's CSP reporting mechanism failed to strip the username:password userinfo component from URLs before sending them in CSP violation reports, meaning that if a page loaded a resource via a URL like https://user:password@example.com/resource, the credentials could be transmitted in plaintext to the CSP report-uri endpoint. The bug was particularly impactful for cross-origin iframes where credentials embedded in URLs could be leaked to a third-party reporting endpoint controlled by an attacker. The fix aligns Firefox's implementation more closely with the CSP specification and was tracked in Mozilla Bugzilla as Bug 1971719; a related spec issue was also filed upstream at the W3C (Mozilla Bugzilla, Mozilla MFSA2025-56).

Successful exploitation could result in the disclosure of HTTP Basic Authentication credentials (username and password) embedded in URLs to unauthorized parties via CSP report endpoints. An attacker who controls a CSP report-uri endpoint — or who can intercept CSP reports — could harvest credentials for affected resources, potentially enabling unauthorized account access, identity theft, or lateral movement into systems protected by those credentials. The impact is primarily a confidentiality breach; integrity and availability are not directly affected. Mozilla noted that exploitation requires atypical conditions: the victim site must use HTTP Basic Authentication with credentials embedded in URLs, and a CSP policy with a report-uri directive must be configured (Mozilla Bugzilla, Mozilla MFSA2025-58).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.108%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Mozilla's internal security team classified it as sec-moderate, noting that exploitation requires phishing-like user behavior and a site configuration using HTTP Basic Authentication with credentials in URLs — conditions that are uncommon in modern web deployments (Mozilla Bugzilla, Feedly).

1. Identify a target site: Find a web application that uses HTTP Basic Authentication with credentials embedded in resource URLs (e.g., https://user:pass@internal.example.com/api/data) and has a CSP policy with a report-uri directive pointing to an attacker-controlled or observable endpoint.
2. Trigger a CSP violation: Craft or identify a scenario where the browser (running a vulnerable Firefox/Thunderbird version) loads a resource from a URL containing embedded credentials that violates the site's CSP policy — for example, by embedding a cross-origin iframe that references such a URL.
3. Capture the CSP report: Monitor the CSP report-uri endpoint for incoming violation reports. Due to the vulnerability, the browser sends the full URL including the username:password portion in the blocked-uri or document-uri field of the JSON report body.
4. Extract credentials: Parse the received CSP report JSON to extract the plaintext credentials from the URL, then use them to authenticate against the target service (Mozilla Bugzilla, Mozilla MFSA2025-56).

• Network: Outbound HTTP POST requests to CSP report-uri endpoints containing URLs with embedded username:password credentials in the blocked-uri or document-uri JSON fields; unexpected CSP violation reports sent to third-party or attacker-controlled domains.
• Logs: Web server or proxy logs showing CSP report submissions with userinfo components (e.g., https://user:pass@host/path) in request bodies; access logs for CSP report endpoints showing credential-bearing URLs.
• Application: CSP violation reports received at report-uri endpoints that include the username:password portion of URLs rather than the sanitized form expected by the specification.

Mozilla has released patched versions that fix this vulnerability: Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird ESR 128.13, and Thunderbird ESR 140.1. Users and administrators should update to these versions immediately. As a temporary workaround, organizations should avoid embedding credentials directly in URLs (which is a broadly discouraged practice) and consider disabling or restricting CSP report-uri directives to trusted, internal endpoints. Rotating any credentials that may have been exposed via CSP reports is also recommended (Mozilla MFSA2025-56, Mozilla MFSA2025-58, Mozilla MFSA2025-59).

Mozilla classified the vulnerability as moderate severity, with internal reviewer Frederik Braun noting that while credential theft via CSP reports could be "really disastrous," exploitation requires atypical user behavior (phishing) and uncommon site configurations (HTTP Basic Authentication with credentials in URLs). The fix was upstreamed to the W3C CSP specification as well, with a related spec issue filed to improve the standard's guidance on URL stripping. Multiple Linux distributions (Debian, Red Hat, SUSE, Oracle Linux, Amazon Linux) and downstream vendors issued security advisories and package updates following the Mozilla release. Security news outlets including GBHackers and CyberSecurityNews covered the Firefox 141 release highlighting the security fixes (Mozilla Bugzilla).