CVE-2021-24002
📋 TL;DR
This vulnerability allows attackers to inject arbitrary FTP commands by tricking users into clicking malicious FTP URLs containing encoded newline characters. When Firefox, Firefox ESR, or Thunderbird processes these URLs, the newlines are interpreted as command separators, enabling unauthorized actions on FTP servers. This affects users of Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.
💻 Affected Systems
- Firefox
- Firefox ESR
- Thunderbird
📦 What is this software?
Firefox by Mozilla
Firefox Esr by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of FTP server through arbitrary command execution, potentially leading to data theft, server takeover, or lateral movement within the network.
Likely Case
Unauthorized file operations on FTP servers, including file upload/download, directory traversal, or server configuration changes.
If Mitigated
Limited impact if FTP servers are isolated, use authentication, or have restricted command permissions.
🎯 Exploit Status
Exploitation requires user interaction (clicking a malicious URL) but is technically simple with publicly available details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox ESR 78.10+, Thunderbird 78.10+, Firefox 88+
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2021-14/
Restart Required: Yes
Instructions:
1. Open the browser/email client. 2. Go to Settings/Help > About. 3. Allow automatic update or manually download latest version from official Mozilla website. 4. Restart the application.
🔧 Temporary Workarounds
Disable FTP protocol handling
allPrevent browsers from processing FTP URLs by disabling FTP protocol support.
For Firefox: Set network.ftp.enabled to false in about:config
Block FTP URLs at network level
allUse firewall or proxy rules to block FTP traffic from browsers.
🧯 If You Can't Patch
- Educate users to avoid clicking FTP URLs, especially from untrusted sources.
- Implement network segmentation to isolate FTP servers and restrict browser access to them.
🔍 How to Verify
Check if Vulnerable:
Check browser version in Settings/Help > About. If version is below Firefox ESR 78.10, Thunderbird 78.10, or Firefox 88, it is vulnerable.Check Version:
Firefox/Thunderbird: Help > About Firefox/ThunderbirdVerify Fix Applied:
Confirm version is Firefox ESR 78.10+, Thunderbird 78.10+, or Firefox 88+ after update.📡 Detection & Monitoring
Log Indicators:
- Unusual FTP commands in server logs, especially containing newline characters or unexpected sequences from browser user-agents.
Network Indicators:
- FTP traffic from browsers containing encoded newlines (%0A, %0D) in URLs.
SIEM Query:
source="ftp_server_logs" AND (command="*\n*" OR command="*\r*" OR url="*%0A*" OR url="*%0D*")🔗 References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1702374
- https://www.mozilla.org/security/advisories/mfsa2021-14/
- https://www.mozilla.org/security/advisories/mfsa2021-15/
- https://www.mozilla.org/security/advisories/mfsa2021-16/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1702374
- https://www.mozilla.org/security/advisories/mfsa2021-14/
- https://www.mozilla.org/security/advisories/mfsa2021-15/
- https://www.mozilla.org/security/advisories/mfsa2021-16/
