CVE-2024-10460
📋 TL;DR
This vulnerability allows attackers to obscure the origin of external protocol handler prompts using data: URLs within iframes, potentially tricking users into executing malicious external applications. It affects Firefox, Firefox ESR, and Thunderbird users running outdated versions. The attack requires user interaction but can bypass security warnings.
💻 Affected Systems
- Firefox
- Firefox ESR
- Thunderbird
📦 What is this software?
Firefox by Mozilla
Firefox by Mozilla
Thunderbird by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Users could be tricked into launching malicious external applications that compromise their system, leading to malware installation, data theft, or ransomware execution.
Likely Case
Attackers could use this to launch phishing attacks where users inadvertently execute harmful external protocols, potentially leading to credential theft or limited system compromise.
If Mitigated
With updated browsers and user awareness, the risk is minimal as the attack still requires user interaction and modern browsers block many dangerous external protocols.
🎯 Exploit Status
Exploitation requires user interaction (clicking a prompt) but is technically simple. No public proof-of-concept has been disclosed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 132+, Firefox ESR 128.4+, Thunderbird 128.4+, Thunderbird 132+
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2024-55/
Restart Required: Yes
Instructions:
1. Open affected application (Firefox/Thunderbird). 2. Click menu → Help → About Firefox/Thunderbird. 3. Application will check for updates and install. 4. Restart when prompted.
🔧 Temporary Workarounds
Disable external protocol handlers
allPrevent external protocol prompts from appearing
about:config → network.protocol-handler.external-default = false
Disable JavaScript
allPrevent the data: URL iframe technique from executing
about:config → javascript.enabled = false
🧯 If You Can't Patch
- Implement web filtering to block malicious sites using this technique
- Educate users to never click external protocol prompts from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check browser version in About dialog. If version is below patched versions, system is vulnerable.Check Version:
firefox --version or thunderbird --versionVerify Fix Applied:
Verify version is at or above: Firefox 132, Firefox ESR 128.4, Thunderbird 128.4, or Thunderbird 132📡 Detection & Monitoring
Log Indicators:
- External protocol handler prompts from data: URLs
- Unusual iframe loading patterns
Network Indicators:
- HTTP requests to sites using data: URLs in iframes with external protocol calls
SIEM Query:
source="browser_logs" AND (event="external_protocol" OR event="iframe_load") AND url CONTAINS "data:"🔗 References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1912537
- https://www.mozilla.org/security/advisories/mfsa2024-55/
- https://www.mozilla.org/security/advisories/mfsa2024-56/
- https://www.mozilla.org/security/advisories/mfsa2024-58/
- https://www.mozilla.org/security/advisories/mfsa2024-59/
- https://lists.debian.org/debian-lts-announce/2024/10/msg00034.html
- https://lists.debian.org/debian-lts-announce/2024/11/msg00001.html
