CVE-2024-10461: Mozilla Firefox XSS Vulnerability

CVE-2024-10461 Overview

CVE-2024-10461 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Mozilla Firefox and Thunderbird. The flaw exists in how the browser processes multipart/x-mixed-replace responses. When such a response includes a Content-Disposition: attachment header, the browser fails to honor the directive and does not force a file download. Attackers can leverage this behavior to render attacker-controlled content inline, enabling script execution in the origin's context. Mozilla addressed the issue in Firefox 132, Firefox ESR 128.4, Thunderbird 128.4, and Thunderbird 132.

Critical Impact
Attackers can bypass the Content-Disposition: attachment protection to execute arbitrary JavaScript in a victim's browser session, enabling session theft, credential harvesting, and cross-origin data exposure.

Affected Products

Mozilla Firefox versions prior to 132
Mozilla Firefox ESR versions prior to 128.4
Mozilla Thunderbird versions prior to 128.4 and prior to 132

Discovery Timeline

2024-10-29 - CVE-2024-10461 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10461

Vulnerability Analysis

The vulnerability resides in Mozilla's handling of multipart/x-mixed-replace HTTP responses. This content type instructs the browser to replace rendered content with each new part in the stream, and is commonly used for server-push scenarios such as MJPEG video feeds. When a server returns a multipart/x-mixed-replace response with the header Content-Disposition: attachment, Firefox and Thunderbird ignore the attachment directive and render the response content inline instead of triggering a download prompt.

Because the response is rendered in the origin of the server, any HTML or JavaScript within the parts executes as trusted content. Web applications that rely on Content-Disposition: attachment as a defense to safely serve user-uploaded or untrusted content are exposed to stored or reflected XSS.

Root Cause

The root cause is a parser and dispatcher mismatch. Mozilla's multipart handler consumed each boundary-delimited part and passed it to the HTML rendering pipeline without re-evaluating the top-level Content-Disposition header. As a result, the browser's download-decision logic was bypassed for this specific response type.

Attack Vector

Exploitation requires user interaction, such as clicking a link or loading a page that references the malicious endpoint. An attacker hosts or uploads content to a target application that returns a multipart/x-mixed-replace response containing HTML and JavaScript payloads. Even if the application sets Content-Disposition: attachment to force a download, the affected browser renders the payload inline within the application's origin. Refer to the Mozilla Bug Report #1914521 for additional technical detail.

// No verified proof-of-concept code is publicly available for CVE-2024-10461.
// The vulnerability is described in prose above. See Mozilla advisories for details.

Detection Methods for CVE-2024-10461

Indicators of Compromise

HTTP responses with Content-Type: multipart/x-mixed-replace served from user-content or file-upload domains that also set Content-Disposition: attachment.
Outbound browser traffic to unfamiliar domains immediately following user clicks on links to file-hosting or webmail endpoints.
Unexpected JavaScript execution reports from Content Security Policy (CSP) endpoints on domains that host user-uploaded files.

Detection Strategies

Inspect web proxy and WAF logs for responses combining multipart/x-mixed-replace with Content-Disposition: attachment, which is an unusual pairing outside of exploitation.
Monitor endpoint browser telemetry for Firefox and Thunderbird versions below the fixed releases to identify vulnerable clients.
Correlate browser process activity with subsequent credential access, cookie theft, or anomalous outbound POST requests.

Monitoring Recommendations

Enforce browser version inventory checks and flag hosts running Firefox below 132 or Firefox ESR below 128.4.
Enable CSP reporting on applications that accept user uploads and route violations to a centralized log store for review.
Alert on Thunderbird processes spawning unexpected child processes or performing network activity outside of mail server destinations.

How to Mitigate CVE-2024-10461

Immediate Actions Required

Update Firefox to version 132 or later and Firefox ESR to 128.4 or later on all managed endpoints.
Update Thunderbird to version 128.4 or 132 or later across all mail clients.
Audit web applications that accept file uploads to confirm they do not emit multipart/x-mixed-replace responses for untrusted content.

Patch Information

Mozilla released fixes in Firefox 132, Firefox ESR 128.4, Thunderbird 128.4, and Thunderbird 132. Review the Mozilla Security Advisory MFSA-2024-55, Mozilla Security Advisory MFSA-2024-56, Mozilla Security Advisory MFSA-2024-58, and Mozilla Security Advisory MFSA-2024-59 for detailed release notes. Debian users should apply the updates announced in the Debian LTS Announcement #34 and Debian LTS Announcement #1.

Workarounds

Serve untrusted user content from a sandboxed origin distinct from the primary application domain to reduce XSS blast radius.
Enforce a strict Content Security Policy that disallows inline scripts on file-serving endpoints.
Where feasible, block or rewrite multipart/x-mixed-replace responses at the web proxy or WAF for domains that host user-uploaded content.

bash

# Example nginx configuration to enforce CSP on a user-content endpoint
location /uploads/ {
    add_header Content-Security-Policy "default-src 'none'; sandbox" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Content-Disposition "attachment" always;
}