Login Sign Up

CVE-2023-32214

7.5 HIGH
Denial of Service

📋 TL;DR

This vulnerability allows attackers to trigger denial of service conditions on Windows systems by exploiting protocol handlers ms-cxh and ms-cxh-full in affected Mozilla products. It affects Firefox, Firefox ESR, and Thunderbird users on Windows operating systems. Other operating systems are not vulnerable.

💻 Affected Systems

Products:
  • Firefox
  • Firefox ESR
  • Thunderbird
Versions: Firefox < 113, Firefox ESR < 102.11, Thunderbird < 102.11
Operating Systems: Windows
Default Config Vulnerable: ⚠️ Yes
Notes: Only affects Windows operating systems. Linux, macOS, and other OS are not vulnerable.

📦 What is this software?

Firefox by Mozilla

View all CVEs affecting Firefox →

Firefox Esr by Mozilla

View all CVEs affecting Firefox Esr →

Thunderbird by Mozilla

View all CVEs affecting Thunderbird →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete application crash or system instability leading to denial of service for the affected browser/email client

🟠

Likely Case

Application crash requiring restart, potentially causing data loss in unsaved sessions

🟢

If Mitigated

No impact if systems are patched or workarounds are implemented

🌐 Internet-Facing: MEDIUM - Requires user interaction with malicious content but can be delivered via web
🏢 Internal Only: MEDIUM - Same attack vectors apply internally if users access malicious content

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Exploitation requires user interaction (clicking malicious link) but no authentication needed

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Firefox 113+, Firefox ESR 102.11+, Thunderbird 102.11+

Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2023-16/

Restart Required: Yes

Instructions:

1. Open Firefox/Thunderbird. 2. Click menu → Help → About Firefox/Thunderbird. 3. Allow automatic update check and installation. 4. Restart application when prompted.

🔧 Temporary Workarounds

Disable protocol handlers

windows

Disable or restrict the ms-cxh and ms-cxh-full protocol handlers via registry or group policy

Windows Registry: HKEY_CLASSES_ROOT\ms-cxh and HKEY_CLASSES_ROOT\ms-cxh-full - modify permissions or delete keys

Use alternative browser

all

Temporarily use alternative browsers until patched

🧯 If You Can't Patch

  • Implement network filtering to block malicious content delivery
  • Educate users to avoid clicking unknown links and enable click-to-play for plugins

🔍 How to Verify

Check if Vulnerable:

Check Firefox/Thunderbird version via menu → Help → About. If version is below patched versions, system is vulnerable.

Check Version:

firefox --version or thunderbird --version

Verify Fix Applied:

Verify version is Firefox 113+, Firefox ESR 102.11+, or Thunderbird 102.11+ after update

📡 Detection & Monitoring

Log Indicators:

  • Application crash logs mentioning protocol handlers
  • Windows Event Logs with application fault for Firefox/Thunderbird

Network Indicators:

  • Traffic containing ms-cxh:// or ms-cxh-full:// protocol handler calls

SIEM Query:

EventID=1000 OR EventID=1001 AND SourceName='Firefox' OR SourceName='Thunderbird'

📊 Metadata

CVE ID: CVE-2023-32214
CVSS v3 Score: 7.5 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: June 19, 2023
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON