CVE-2024-11693
📋 TL;DR
This vulnerability in Firefox and Thunderbird allows attackers to download .library-ms files without the usual executable file warning on Windows systems. This could enable social engineering attacks where users are tricked into opening malicious files. It affects Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR on Windows operating systems.
💻 Affected Systems
- Firefox
- Firefox ESR
- Thunderbird
- Thunderbird ESR
📦 What is this software?
Firefox by Mozilla
Firefox by Mozilla
Thunderbird by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Attackers could deliver malicious .library-ms files that execute arbitrary code when opened, potentially leading to full system compromise.
Likely Case
Social engineering attacks where users are tricked into downloading and opening malicious .library-ms files, potentially leading to malware installation.
If Mitigated
Users who don't open downloaded files or have additional security controls would be protected, though the missing warning increases risk.
🎯 Exploit Status
Exploitation requires user interaction (downloading and opening the file). The vulnerability bypasses security warnings but doesn't automatically execute code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 133+, Firefox ESR 128.5+, Thunderbird 133+, Thunderbird ESR 128.5+
Vendor Advisory: https://www.mozilla.org/security/advisories/
Restart Required: Yes
Instructions:
1. Open Firefox/Thunderbird. 2. Click menu → Help → About Firefox/Thunderbird. 3. Allow the browser to check for and install updates. 4. Restart the application when prompted.
🔧 Temporary Workarounds
Disable .library-ms file downloads
windowsConfigure Firefox/Thunderbird to block .library-ms file downloads entirely
about:config → browser.download.manager.alertOnEXEOpen = true
about:config → browser.download.manager.alertOnEXEOpen.library-ms = true
Use alternative browser temporarily
allSwitch to a different browser until patches are applied
🧯 If You Can't Patch
- Educate users not to open downloaded .library-ms files from untrusted sources
- Implement application whitelisting to block execution of .library-ms files
🔍 How to Verify
Check if Vulnerable:
Check Firefox/Thunderbird version in Help → About. If version is below patched versions, system is vulnerable.Check Version:
firefox --version or thunderbird --versionVerify Fix Applied:
After updating, verify version is at or above Firefox 133, Firefox ESR 128.5, Thunderbird 133, or Thunderbird ESR 128.5.📡 Detection & Monitoring
Log Indicators:
- Downloads of .library-ms files in browser logs
- Unexpected .library-ms file executions in Windows Event Logs
Network Indicators:
- Downloads of .library-ms files from suspicious domains
- Unusual download patterns for library files
SIEM Query:
source="browser_logs" AND file_extension=".library-ms" OR source="windows_security" AND process_name="*.library-ms"