CVE-2024-9399
📋 TL;DR
A denial-of-service vulnerability in Firefox, Firefox ESR, and Thunderbird allows a malicious website to crash the browser process by initiating a specially crafted WebTransport session. This affects all users running vulnerable versions of these Mozilla products. The crash occurs without user interaction beyond visiting the malicious site.
💻 Affected Systems
- Firefox
- Firefox ESR
- Thunderbird
📦 What is this software?
Firefox by Mozilla
Firefox by Mozilla
Thunderbird by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Complete browser/application crash leading to loss of unsaved work and disruption of productivity. Repeated exploitation could make the application unusable.
Likely Case
Temporary denial of service where the browser crashes and needs to be restarted, potentially losing active sessions and unsaved data.
If Mitigated
No impact if patched versions are deployed or if users avoid untrusted websites.
🎯 Exploit Status
Exploitation requires only visiting a malicious website. No authentication or special permissions needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 131+, Firefox ESR 128.3+, Thunderbird 128.3+, Thunderbird 131+
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2024-46/
Restart Required: Yes
Instructions:
1. Open Firefox/Thunderbird. 2. Click menu → Help → About Firefox/Thunderbird. 3. Allow automatic update check and installation. 4. Restart the application when prompted.
🔧 Temporary Workarounds
Disable WebTransport
allDisable WebTransport feature via about:config to prevent exploitation
Set network.http.http3.enable to false in about:config
Use script blockers
allConfigure browser extensions to block JavaScript/WebTransport on untrusted sites
🧯 If You Can't Patch
- Restrict browsing to trusted websites only
- Implement network filtering to block malicious domains and WebTransport traffic
🔍 How to Verify
Check if Vulnerable:
Check browser version in About dialog. If version is below patched versions, system is vulnerable.Check Version:
firefox --version or thunderbird --versionVerify Fix Applied:
Verify version is equal to or higher than patched versions: Firefox ≥131, Firefox ESR ≥128.3, Thunderbird ≥128.3 or ≥131.📡 Detection & Monitoring
Log Indicators:
- Browser crash logs
- Unexpected process termination events
- WebTransport session initiation failures
Network Indicators:
- WebTransport protocol traffic to suspicious domains
- Multiple rapid connection attempts
SIEM Query:
source="browser_logs" AND (event="crash" OR event="process_termination") AND process_name IN ("firefox", "thunderbird")