CVE-2023-49060: Firefox iOS Information Disclosure Flaw

CVE-2023-49060 Overview

CVE-2023-49060 is a critical information disclosure vulnerability affecting Mozilla Firefox for iOS that enables attackers to exfiltrate security keys from the browser's ReaderMode feature via the referrerpolicy attribute. This vulnerability allows unauthorized access to internal pages and sensitive data through improper handling of referrer policy directives within the ReaderMode implementation.

Critical Impact

Attackers can extract security keys from ReaderMode to gain unauthorized access to internal browser pages and sensitive user data without requiring any user interaction or authentication.

Affected Products

• Mozilla Firefox for iOS versions prior to 120
• Firefox ReaderMode component on iPhone OS
• All users of Firefox for iOS not updated to version 120 or later

Discovery Timeline

• 2023-11-21 - CVE-2023-49060 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-49060

Vulnerability Analysis

This vulnerability resides in the ReaderMode functionality of Firefox for iOS, specifically in how the browser handles the referrerpolicy HTML attribute. ReaderMode is designed to provide a distraction-free reading experience by stripping away unnecessary page elements, but the implementation contained a flaw that exposed internal security mechanisms.

The core issue stems from improper information exposure where security keys used internally by the ReaderMode feature could be leaked through referrer headers when the referrerpolicy attribute was manipulated by a malicious actor. This allows an attacker-controlled page to capture these security keys and subsequently use them to access privileged internal browser pages or sensitive data that should be protected.

The attack can be executed remotely over the network, requires no special privileges, and does not necessitate any user interaction—making it particularly dangerous for unsuspecting users browsing attacker-controlled websites.

Root Cause

The root cause of this vulnerability is improper information exposure through the referrer policy mechanism. The ReaderMode implementation failed to properly sanitize or restrict the transmission of security keys when processing pages with attacker-controlled referrerpolicy attributes. This allowed sensitive internal tokens to be included in referrer headers and subsequently captured by external servers.

The vulnerability falls under the category of information leakage where browser-internal security credentials were inadvertently exposed to potentially malicious websites through standard HTTP referrer mechanisms.

Attack Vector

The attack vector for CVE-2023-49060 is network-based and involves the following exploitation flow:

An attacker crafts a malicious webpage containing specific referrerpolicy attribute configurations designed to trigger the security key leakage. When a Firefox for iOS user visits this page and engages the ReaderMode feature, the browser inadvertently includes internal security keys in HTTP referrer headers sent to attacker-controlled endpoints.

Once the attacker captures these security keys, they can replay them to access internal Firefox pages or data stores that rely on these keys for authorization. The vulnerability requires no authentication and can be exploited without any user interaction beyond normal browsing activity.

For technical details on the exploitation mechanism, refer to the Mozilla Bug Report #1861405 and the Mozilla Security Advisory MFSA-2023-51.

Detection Methods for CVE-2023-49060

Indicators of Compromise

• Unusual referrer headers originating from Firefox for iOS ReaderMode sessions containing unexpected token patterns
• Network traffic to unknown external domains during ReaderMode activation
• Evidence of internal page access from unauthorized sessions or contexts
• Abnormal HTTP referrer values in server logs when users access ReaderMode content

Detection Strategies

• Monitor network traffic for anomalous referrer header patterns when ReaderMode is active on iOS devices
• Implement network-based detection for connections to known malicious domains during browser sessions
• Review web server logs for unusual referrer strings that may indicate attempted key exfiltration
• Deploy endpoint detection rules to identify Firefox for iOS versions prior to 120 in the environment

Monitoring Recommendations

• Maintain an inventory of Firefox for iOS versions across mobile device fleets using MDM solutions
• Configure network monitoring to alert on suspicious outbound traffic patterns from iOS devices
• Implement web filtering to block access to known exploit delivery sites
• Enable enhanced logging for mobile browser network activity in enterprise environments

How to Mitigate CVE-2023-49060

Immediate Actions Required

• Update Firefox for iOS to version 120 or later immediately to remediate the vulnerability
• Review mobile device management policies to ensure timely browser updates are enforced
• Consider temporarily disabling ReaderMode on unpatched devices if immediate updates are not possible
• Audit recent network traffic from iOS devices for potential exploitation indicators

Patch Information

Mozilla has addressed this vulnerability in Firefox for iOS version 120. Users should update their browser through the Apple App Store to receive the security fix. The official security advisory is available at Mozilla Security Advisory MFSA-2023-51.

Organizations using mobile device management (MDM) solutions should push the Firefox for iOS update to all managed devices and verify installation completion.

Workarounds

• Avoid using ReaderMode on untrusted websites until the browser is updated
• Use alternative browsers on iOS devices until Firefox can be patched
• Implement network-level controls to restrict access to potentially malicious sites
• Educate users about the risks of browsing untrusted content with vulnerable browser versions

# Verify Firefox for iOS version via MDM
# Ensure version 120 or later is deployed across all managed iOS devices
# Example: Check app inventory for Firefox versions below 120
mdm-query --app "Firefox" --platform ios --version-below "120"