CVE-2025-0239
📋 TL;DR
This vulnerability allows attackers to bypass certificate validation when Firefox or Thunderbird redirects from a secure server to an insecure one using Alt-Svc. This could enable man-in-the-middle attacks. Affected users include anyone using vulnerable versions of Firefox, Firefox ESR, or Thunderbird.
💻 Affected Systems
- Firefox
- Firefox ESR
- Thunderbird
📦 What is this software?
Firefox by Mozilla
Firefox by Mozilla
Thunderbird by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Man-in-the-middle attacker intercepts and manipulates traffic between user and legitimate server, potentially stealing sensitive data or injecting malicious content.
Likely Case
Limited information disclosure or session hijacking in targeted attacks against users on compromised networks.
If Mitigated
No impact if patched; minimal risk if users avoid untrusted networks and sites.
🎯 Exploit Status
Exploitation requires network position to intercept traffic and knowledge of vulnerable configurations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 134+, Firefox ESR 128.6+, Thunderbird 134+, Thunderbird 128.6+
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2025-01/
Restart Required: Yes
Instructions:
1. Open affected application. 2. Go to Help > About Firefox/Thunderbird. 3. Allow automatic update check and installation. 4. Restart application when prompted.
🔧 Temporary Workarounds
Disable Alt-Svc
allPrevents use of Alt-Svc feature that triggers the vulnerability
about:config
Set network.http.altsvc.enabled to false
🧯 If You Can't Patch
- Restrict browser usage to trusted networks only
- Implement network monitoring for unusual certificate validation failures
🔍 How to Verify
Check if Vulnerable:
Check application version in Help > About menu and compare to affected versions.Check Version:
firefox --version or thunderbird --versionVerify Fix Applied:
Confirm version is Firefox 134+, Firefox ESR 128.6+, Thunderbird 134+, or Thunderbird 128.6+.📡 Detection & Monitoring
Log Indicators:
- Certificate validation errors for Alt-Svc connections
- Unexpected redirects from HTTPS to HTTP
Network Indicators:
- Unencrypted traffic following secure connections
- Alt-Svc header manipulation
SIEM Query:
source="browser_logs" AND (event="certificate_error" OR event="redirect") AND url="http://*"🔗 References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1929156
- https://www.mozilla.org/security/advisories/mfsa2025-01/
- https://www.mozilla.org/security/advisories/mfsa2025-02/
- https://www.mozilla.org/security/advisories/mfsa2025-04/
- https://www.mozilla.org/security/advisories/mfsa2025-05/
- https://lists.debian.org/debian-lts-announce/2025/01/msg00004.html
