CVE-2023-37201
📋 TL;DR
This vulnerability allows an attacker to trigger a use-after-free condition when establishing a WebRTC connection over HTTPS, potentially leading to arbitrary code execution. It affects Firefox versions below 115, Firefox ESR below 102.13, and Thunderbird below 102.13. Users of these outdated browsers and email clients are at risk.
💻 Affected Systems
- Mozilla Firefox
- Mozilla Firefox ESR
- Mozilla Thunderbird
📦 What is this software?
Firefox by Mozilla
Firefox Esr by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the browser process, potentially leading to full system compromise.
Likely Case
Browser crash (denial of service) or limited memory corruption leading to information disclosure.
If Mitigated
No impact if patched versions are used or if WebRTC/HTTPS connections are blocked.
🎯 Exploit Status
Exploitation requires tricking a user into visiting a malicious website or opening a malicious email with WebRTC content.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 115, Firefox ESR 102.13, Thunderbird 102.13
Vendor Advisory: https://bugzilla.mozilla.org/show_bug.cgi?id=1826002
Restart Required: Yes
Instructions:
1. Open the browser/email client. 2. Go to Settings/Preferences > General/About. 3. Allow the application to check for and install updates. 4. Restart the application when prompted.
🔧 Temporary Workarounds
Disable WebRTC
allPrevents the vulnerable component from being used.
In Firefox/Thunderbird: about:config > set media.peerconnection.enabled to false
Block HTTPS connections to untrusted sites
allReduces attack surface by limiting WebRTC over HTTPS.
Use browser extensions or network policies to restrict HTTPS access
🧯 If You Can't Patch
- Restrict user access to untrusted websites and email content.
- Implement application whitelisting to prevent execution of malicious code.
🔍 How to Verify
Check if Vulnerable:
Check the version in the browser/email client: Firefox/Thunderbird > Help > About.Check Version:
On Linux: firefox --version | thunderbird --versionVerify Fix Applied:
Confirm the version is Firefox 115+, Firefox ESR 102.13+, or Thunderbird 102.13+.📡 Detection & Monitoring
Log Indicators:
- Browser/email client crash logs with memory corruption errors
- Unexpected WebRTC connection attempts in application logs
Network Indicators:
- Unusual HTTPS traffic to/from browser on WebRTC ports (e.g., 443, 3478)
SIEM Query:
source="browser_logs" AND (event="crash" OR event="memory_error")🔗 References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1826002
- https://lists.debian.org/debian-lts-announce/2023/07/msg00006.html
- https://lists.debian.org/debian-lts-announce/2023/07/msg00015.html
- https://www.debian.org/security/2023/dsa-5450
- https://www.debian.org/security/2023/dsa-5451
- https://www.mozilla.org/security/advisories/mfsa2023-22/
- https://www.mozilla.org/security/advisories/mfsa2023-23/
- https://www.mozilla.org/security/advisories/mfsa2023-24/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1826002
- https://lists.debian.org/debian-lts-announce/2023/07/msg00006.html
- https://lists.debian.org/debian-lts-announce/2023/07/msg00015.html
- https://www.debian.org/security/2023/dsa-5450
- https://www.debian.org/security/2023/dsa-5451
- https://www.mozilla.org/security/advisories/mfsa2023-22/
- https://www.mozilla.org/security/advisories/mfsa2023-23/
- https://www.mozilla.org/security/advisories/mfsa2023-24/
