CVE-2024-9398
📋 TL;DR
This vulnerability allows attackers to detect whether specific protocol handler applications are installed on a user's system by exploiting how Firefox and Thunderbird handle window.open calls. It affects Firefox versions below 131, Firefox ESR below 128.3, and Thunderbird versions below 128.3 and 131. Attackers can use this information for targeted attacks.
💻 Affected Systems
- Firefox
- Firefox ESR
- Thunderbird
📦 What is this software?
Firefox by Mozilla
Firefox Esr by Mozilla
Thunderbird by Mozilla
Thunderbird by Mozilla
Thunderbird by Mozilla
Thunderbird by Mozilla
Thunderbird by Mozilla
Thunderbird by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Attackers fingerprint user systems to identify vulnerable software for targeted exploitation, potentially leading to malware installation or credential theft.
Likely Case
Attackers gather reconnaissance data about installed applications to craft more effective phishing or social engineering attacks.
If Mitigated
Limited to information disclosure about installed applications without direct code execution or data access.
🎯 Exploit Status
Exploitation requires JavaScript execution in browser context but no authentication or special privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 131+, Firefox ESR 128.3+, Thunderbird 128.3+, Thunderbird 131+
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2024-46/
Restart Required: Yes
Instructions:
1. Open Firefox/Thunderbird. 2. Click menu → Help → About Firefox/Thunderbird. 3. Allow automatic update check and installation. 4. Restart browser when prompted.
🔧 Temporary Workarounds
Disable JavaScript
allPrevents exploitation by blocking JavaScript execution, which is required for the attack.
Use Content Security Policy
allImplement strict CSP to restrict protocol handler usage and window.open behavior.
🧯 If You Can't Patch
- Restrict browser usage to trusted websites only
- Implement network filtering to block malicious domains and scripts
🔍 How to Verify
Check if Vulnerable:
Check browser version in About dialog. If version is below patched versions, system is vulnerable.Check Version:
firefox --version or thunderbird --versionVerify Fix Applied:
Confirm version is Firefox 131+, Firefox ESR 128.3+, Thunderbird 128.3+, or Thunderbird 131+.📡 Detection & Monitoring
Log Indicators:
- Multiple window.open calls with different protocol handlers
- Unusual protocol handler access attempts
Network Indicators:
- Requests to known malicious domains with JavaScript payloads
SIEM Query:
source="browser_logs" AND (event="window.open" OR protocol_handler="*")