CVE-2023-4580: Firefox Information Disclosure Vulnerability

CVE-2023-4580 Overview

CVE-2023-4580 is an information disclosure vulnerability in Mozilla Firefox, Firefox ESR, and Thunderbird. Push notifications received during private browsing mode were written to disk without encryption. This behavior contradicts the privacy expectations of private browsing sessions, which should not persist sensitive data in plaintext.

Attackers with local access to the disk, or malware running with file system read permissions, can recover push notification content. The notifications may include message previews, sender identifiers, or other sensitive data from web applications such as messaging, email, or social platforms.

Critical Impact
Sensitive push notification content from private browsing sessions persisted on disk in unencrypted form, enabling local information disclosure on shared or compromised systems.

Affected Products

Mozilla Firefox versions prior to 117
Mozilla Firefox ESR versions prior to 115.2
Mozilla Thunderbird versions prior to 115.2

Discovery Timeline

2023-09-11 - CVE-2023-4580 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-4580

Vulnerability Analysis

The flaw is classified under [CWE-311]: Missing Encryption of Sensitive Data. Firefox supports the Web Push API, allowing websites to deliver notifications through the browser even when the user is not actively viewing the site. When operating in private browsing mode, the browser is expected to avoid persisting session-derived data, or to encrypt any data it must retain.

In affected versions, push notification payloads received during private browsing sessions were written to disk in cleartext. The data remained on the file system after the private browsing window closed, defeating the ephemeral guarantees of the mode. Any process with read access to the user profile directory could inspect notification content.

The vulnerability affects confidentiality only. It does not enable code execution, privilege escalation, or modification of browser state. Exploitation requires either local file system access or a separate vulnerability that grants such access.

Root Cause

The push notification storage path did not branch on the private browsing state. The code persisted notification payloads using the standard on-disk store without applying encryption or routing the data to volatile memory only. The privacy guarantees expected for private browsing were not enforced for this specific subsystem.

Attack Vector

Exploitation requires access to the victim's user profile directory on disk. Scenarios include shared workstations, stolen or disposed devices, forensic recovery of storage media, or secondary malware with file read permissions. The attacker reads the unencrypted notification store and extracts message content, sender metadata, or service identifiers tied to the user's private browsing session.

No verified public exploit code is available for this issue. The Mozilla security advisories MFSA-2023-34, MFSA-2023-36, and MFSA-2023-38 describe the fix scope.

Detection Methods for CVE-2023-4580

Indicators of Compromise

Presence of unencrypted push notification data within the Firefox or Thunderbird profile directory on hosts running pre-patch versions.
Access events on the user profile directory by processes other than the browser itself, particularly by interactive shells or unknown binaries.
Outbound transfers of files originating from the browser profile path to non-browser endpoints.

Detection Strategies

Inventory installed Firefox, Firefox ESR, and Thunderbird versions across the environment and flag instances below 117, 115.2, and 115.2 respectively.
Monitor read access to Mozilla profile directories by non-Mozilla processes using endpoint telemetry.
Alert on archival or exfiltration of files from user profile paths, including .sqlite databases and notification stores.

Monitoring Recommendations

Track Mozilla advisory feeds (MFSA-2023-34, MFSA-2023-36, MFSA-2023-38) and correlate against deployed browser inventories.
Log and review file access patterns on multi-user systems where private browsing is in use.
Audit endpoints for stale Firefox or Thunderbird installations on a recurring schedule.

How to Mitigate CVE-2023-4580

Immediate Actions Required

Update Firefox to version 117 or later on all endpoints.
Update Firefox ESR to version 115.2 or later for managed enterprise deployments.
Update Thunderbird to version 115.2 or later on all systems where it is installed.
After patching, clear residual data from existing profile directories to remove any unencrypted notification artifacts written by vulnerable versions.

Patch Information

Mozilla addressed this issue in the September 2023 release cycle. Patches are documented in Mozilla Security Advisory MFSA-2023-34, MFSA-2023-36, and MFSA-2023-38. The underlying bug tracking entry is available at Mozilla Bug Report #1843046.

Workarounds

Disable push notifications in browser preferences when private browsing is in use until patches are deployed.
Apply full-disk encryption on endpoints to reduce exposure if devices are lost or decommissioned.
Restrict interactive logon and file system access on shared workstations to limit local recovery of profile data.

bash

# Verify installed Firefox version on Linux endpoints
firefox --version

# Verify Thunderbird version
thunderbird --version

# On Windows, query installed version via registry
reg query "HKLM\SOFTWARE\Mozilla\Mozilla Firefox" /v CurrentVersion