CVE-2024-5692: Mozilla Firefox Path Traversal Vulnerability

CVE-2024-5692 Overview

CVE-2024-5692 is a file extension handling flaw affecting Mozilla Firefox, Firefox Extended Support Release (ESR), and Thunderbird on Windows 10. When a user invokes the browser's Save As functionality, an attacker can trick the browser into persisting a file with a disallowed extension such as .url by embedding an invalid character in the extension. The issue is specific to Windows and does not affect other operating systems. Successful exploitation requires user interaction to save the attacker-supplied file. The flaw impacts Firefox versions before 127, Firefox ESR before 115.12, and Thunderbird before 115.12.

Critical Impact
An attacker can bypass Mozilla's download extension restrictions and place a Windows Internet Shortcut (.url) file on disk, enabling downstream social-engineering attacks that lead to code execution.

Affected Products

Mozilla Firefox versions prior to 127
Mozilla Firefox ESR versions prior to 115.12
Mozilla Thunderbird versions prior to 115.12 running on Microsoft Windows 10

Discovery Timeline

2024-06-11 - CVE-2024-5692 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5692

Vulnerability Analysis

The vulnerability resides in the file naming logic used by Firefox and Thunderbird when the user chooses Save As on Windows 10. Mozilla maintains an internal deny list of extensions that should not be saved directly through the browser, including Windows Internet Shortcut files (.url). The sanitization routine matches extensions using strict character comparisons, so an attacker who inserts an invalid character into the extension string can slip a disallowed extension past the check. Windows Explorer, however, tolerates and normalizes these malformed extensions when the file is later rendered or double-clicked, treating the artifact as a functional .url shortcut. The mismatch between browser-side validation and operating system extension parsing is the root of the issue.

Root Cause

The defect is an input validation failure ([CWE-20]) in the Windows-specific save path. Mozilla's suggested-filename logic normalizes and strips characters differently from the Windows shell, allowing crafted extensions to bypass the disallow list while still resolving to an executable shortcut format on disk.

Attack Vector

Exploitation requires a victim to visit an attacker-controlled page or open a malicious email and choose to save an attachment. The web content supplies a filename such as document.ur{invalid}l, which the browser accepts because the extension no longer matches the blocked .url entry. Windows then resolves the saved file as a legitimate Internet Shortcut that can point to arbitrary URIs, including file:// paths on SMB servers used to launch remote payloads.

The vulnerability manifests in the browser's Save As filename
sanitization on Windows 10. No verified public proof-of-concept
code is available. See the Mozilla Bugzilla report #1891234 and
advisories MFSA-2024-25, MFSA-2024-26, and MFSA-2024-28 for
official technical details.

Detection Methods for CVE-2024-5692

Indicators of Compromise

Newly created files in user download directories with unusual extension strings containing non-printable or reserved characters that resolve to .url on Windows
Internet Shortcut (.url) files originating from browser or mail client downloads that reference remote SMB (file://) or unusual URI schemes
Firefox or Thunderbird process writing files that Explorer subsequently interprets as shortcuts pointing to attacker-controlled hosts

Detection Strategies

Inspect endpoint file-creation telemetry for firefox.exe or thunderbird.exe writing files whose on-disk extension differs from the extension recorded in browser history
Alert on .url files created in %USERPROFILE%\Downloads that contain URL=file:// or URL=\\ entries pointing to external hosts
Correlate browser download events with subsequent explorer.exe or rundll32.exe executions launched from the saved shortcut

Monitoring Recommendations

Enable Sysmon Event ID 11 (FileCreate) monitoring for Mozilla product processes and forward events to a central analytics platform
Track outbound SMB and WebDAV connections initiated shortly after browser download activity
Audit installed Firefox, Firefox ESR, and Thunderbird versions across the fleet to identify hosts still running vulnerable builds

How to Mitigate CVE-2024-5692

Immediate Actions Required

Upgrade Firefox to version 127 or later on all Windows endpoints
Upgrade Firefox ESR and Thunderbird to version 115.12 or later
Restrict or block outbound SMB (TCP/445) traffic to untrusted networks to limit the impact of malicious .url shortcuts

Patch Information

Mozilla addressed the flaw in the June 2024 release cycle. Refer to Mozilla Security Advisory MFSA-2024-25, MFSA-2024-26, and MFSA-2024-28 for the fixed versions. Technical background is available in Mozilla Bug Report #1891234.

Workarounds

Instruct users to avoid using Save As for untrusted web content until the browser is patched
Configure Group Policy to prevent execution of .url files from user-writable directories such as Downloads and Temp
Deploy attack surface reduction rules that block child processes spawned by explorer.exe from Internet Shortcut launches

bash

# Example: block outbound SMB to the internet using Windows Firewall
netsh advfirewall firewall add rule name="Block Outbound SMB" \
  dir=out action=block protocol=TCP remoteport=445 \
  remoteip=any profile=any