CVE-2024-8383
📋 TL;DR
Firefox versions before 130, 128.2 ESR, and 115.15 ESR automatically launch external applications for news: and snews: schemes without user confirmation. This allows malicious websites to execute untrusted programs that users may have installed, potentially leading to arbitrary code execution. All Firefox users on affected versions are vulnerable.
💻 Affected Systems
- Mozilla Firefox
- Mozilla Firefox ESR
📦 What is this software?
Firefox by Mozilla
Firefox Esr by Mozilla
Firefox Esr by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Arbitrary code execution with user privileges if a malicious program has been installed and registered as a newsreader handler.
Likely Case
Execution of unwanted applications that could perform malicious actions like data theft, ransomware deployment, or system compromise.
If Mitigated
No impact if Firefox is patched or if no untrusted newsreader applications are installed.
🎯 Exploit Status
Exploitation requires user to visit a malicious website and have an untrusted newsreader installed. No authentication needed for the web-based trigger.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 130, Firefox ESR 128.2, Firefox ESR 115.15
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2024-39/
Restart Required: Yes
Instructions:
1. Open Firefox. 2. Click menu → Help → About Firefox. 3. Firefox will check for updates and install if available. 4. Restart Firefox when prompted.
🔧 Temporary Workarounds
Disable news: and snews: scheme handling
allPrevent Firefox from attempting to handle news-related schemes by modifying browser settings.
about:config
Set network.protocol-handler.external.news to false
Set network.protocol-handler.external.snews to false
🧯 If You Can't Patch
- Restrict user installation of untrusted applications through application control policies.
- Use network filtering to block access to known malicious websites that could exploit this vulnerability.
🔍 How to Verify
Check if Vulnerable:
Check Firefox version via menu → Help → About Firefox. If version is below 130 (or ESR below 128.2/115.15), system is vulnerable.Check Version:
firefox --versionVerify Fix Applied:
After update, confirm version is Firefox 130 or higher, or ESR 128.2/115.15 or higher.📡 Detection & Monitoring
Log Indicators:
- Firefox logs showing news: or snews: URL access attempts
- System logs showing unexpected application launches from browser processes
Network Indicators:
- HTTP requests to websites containing news: or snews: links in referrer or URL parameters
SIEM Query:
source="firefox.log" AND ("news:" OR "snews:")🔗 References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1908496
- https://www.mozilla.org/security/advisories/mfsa2024-39/
- https://www.mozilla.org/security/advisories/mfsa2024-40/
- https://www.mozilla.org/security/advisories/mfsa2024-41/
- https://lists.debian.org/debian-lts-announce/2024/09/msg00012.html
- https://lists.debian.org/debian-lts-announce/2024/09/msg00025.html
