CVE-2024-43112
📋 TL;DR
A cross-site scripting (XSS) vulnerability in Firefox for iOS allows attackers to execute malicious scripts by tricking users into long-pressing on specially crafted download links. This affects Firefox for iOS users running versions below 129. The vulnerability could lead to session hijacking, data theft, or redirection to malicious sites.
💻 Affected Systems
- Firefox for iOS
📦 What is this software?
Firefox by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, authentication tokens, or sensitive user data, potentially leading to account takeover, financial fraud, or installation of malware through social engineering.
Likely Case
Attackers could perform limited session hijacking, redirect users to phishing sites, or steal non-critical user data from vulnerable sessions.
If Mitigated
With proper content security policies and user awareness, impact is limited to isolated session compromise that can be cleared by logging out.
🎯 Exploit Status
Exploitation requires user interaction (long-press on malicious link) and social engineering to deliver the payload.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox for iOS 129
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2024-36/
Restart Required: Yes
Instructions:
1. Open the App Store on your iOS device. 2. Search for Firefox. 3. Tap Update to install version 129 or higher. 4. Restart Firefox after update completes.
🔧 Temporary Workarounds
Disable JavaScript for untrusted sites
iosConfigure Firefox to block JavaScript on untrusted websites to prevent XSS payload execution
Settings > Content Blocking > Custom > Uncheck JavaScript
Use alternative browser temporarily
iosSwitch to Safari or another updated browser until Firefox is patched
🧯 If You Can't Patch
- Educate users to avoid long-pressing on download links from untrusted sources
- Implement web application firewalls (WAF) with XSS protection rules for enterprise environments
🔍 How to Verify
Check if Vulnerable:
Open Firefox on iOS, go to Settings > About Firefox, check if version is below 129Check Version:
Settings > About FirefoxVerify Fix Applied:
After updating, confirm version is 129 or higher in Settings > About Firefox📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript execution patterns in browser logs
- Multiple failed download attempts from same session
Network Indicators:
- Suspicious JavaScript payloads in HTTP requests
- Unexpected redirects to external domains
SIEM Query:
source="firefox_logs" AND (event="javascript_execution" OR event="download_initiated") AND user_interaction="long_press"