CVE-2024-0750
📋 TL;DR
A timing vulnerability in Firefox, Firefox ESR, and Thunderbird allows attackers to manipulate popup notification delays, tricking users into granting unintended permissions. This affects users running vulnerable versions of these applications. Attackers could exploit this through malicious websites or emails.
💻 Affected Systems
- Firefox
- Firefox ESR
- Thunderbird
📦 What is this software?
Firefox by Mozilla
Firefox Esr by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain unauthorized permissions (camera, microphone, location, notifications) leading to privacy violations, data theft, or further system compromise.
Likely Case
Users inadvertently grant permissions to malicious sites, enabling tracking, unwanted notifications, or limited data access.
If Mitigated
With user awareness training and proper browser settings, exploitation attempts are recognized and denied.
🎯 Exploit Status
Exploitation requires user interaction but is straightforward via malicious websites or emails.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 122, Firefox ESR 115.7, Thunderbird 115.7
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2024-01/
Restart Required: Yes
Instructions:
1. Open the application. 2. Go to Help > About Firefox/Thunderbird. 3. Allow the update to download and install. 4. Restart the application.
🔧 Temporary Workarounds
Disable automatic permission prompts
allConfigure browser to block permission requests by default
about:config > permissions.default.image = 2
about:config > permissions.default.geo = 2
🧯 If You Can't Patch
- Train users to be cautious with permission prompts and verify URLs before granting access.
- Use alternative browsers or email clients that are not affected by this vulnerability.
🔍 How to Verify
Check if Vulnerable:
Check the application version in Help > About Firefox/Thunderbird and compare to affected versions.Check Version:
firefox --version or thunderbird --versionVerify Fix Applied:
Confirm version is Firefox ≥122, Firefox ESR ≥115.7, or Thunderbird ≥115.7.📡 Detection & Monitoring
Log Indicators:
- Unusual permission grants in browser logs
- Multiple permission prompts from single site in short timeframe
Network Indicators:
- Requests to known malicious domains triggering permission prompts
SIEM Query:
source="browser_logs" AND event="permission_granted" AND user_agent="*Firefox*" AND version<122🔗 References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1863083
- https://lists.debian.org/debian-lts-announce/2024/01/msg00015.html
- https://lists.debian.org/debian-lts-announce/2024/01/msg00022.html
- https://www.mozilla.org/security/advisories/mfsa2024-01/
- https://www.mozilla.org/security/advisories/mfsa2024-02/
- https://www.mozilla.org/security/advisories/mfsa2024-04/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1863083
- https://lists.debian.org/debian-lts-announce/2024/01/msg00015.html
- https://lists.debian.org/debian-lts-announce/2024/01/msg00022.html
- https://www.mozilla.org/security/advisories/mfsa2024-01/
- https://www.mozilla.org/security/advisories/mfsa2024-02/
- https://www.mozilla.org/security/advisories/mfsa2024-04/
