CVE-2024-4772
📋 TL;DR
CVE-2024-4772 is a vulnerability in Firefox where HTTP digest authentication nonce values were generated using the predictable rand() function instead of cryptographically secure random number generation. This could allow attackers to predict authentication nonces and potentially bypass authentication. The vulnerability affects Firefox versions before 126.
💻 Affected Systems
- Mozilla Firefox
📦 What is this software?
Firefox by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Attackers could predict authentication nonces to bypass HTTP digest authentication, potentially gaining unauthorized access to protected resources or performing session hijacking.
Likely Case
Limited authentication bypass in specific scenarios where HTTP digest authentication is used, requiring attacker proximity and timing.
If Mitigated
Minimal impact if systems use stronger authentication methods or have network segmentation limiting attack surface.
🎯 Exploit Status
Exploitation requires predicting nonce values and timing attacks against HTTP digest authentication, which is less commonly used than other authentication methods.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 126 and later
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2024-21/
Restart Required: Yes
Instructions:
1. Open Firefox. 2. Click menu > Help > About Firefox. 3. Firefox will check for updates and install Firefox 126 or later. 4. Restart Firefox when prompted.
🔧 Temporary Workarounds
Disable HTTP Digest Authentication
allConfigure web servers to use more secure authentication methods like OAuth, SAML, or certificate-based authentication instead of HTTP digest authentication.
Use Alternative Browser
allTemporarily use a different browser that is not affected by this vulnerability until Firefox can be updated.
🧯 If You Can't Patch
- Implement network segmentation to isolate systems using HTTP digest authentication
- Enable additional authentication factors for systems using HTTP digest authentication
🔍 How to Verify
Check if Vulnerable:
Check Firefox version: 1. Open Firefox. 2. Click menu > Help > About Firefox. 3. If version is less than 126, system is vulnerable.Check Version:
firefox --versionVerify Fix Applied:
After updating, verify Firefox version is 126 or higher using the same steps.📡 Detection & Monitoring
Log Indicators:
- Multiple failed HTTP digest authentication attempts from same source
- Successful authentication with unusual timing patterns
Network Indicators:
- HTTP traffic with digest authentication headers showing predictable nonce patterns
SIEM Query:
source="firefox.log" AND (event="authentication_failure" OR event="authentication_success") AND auth_method="digest"