CVE-2024-9397 Overview
CVE-2024-9397 is a clickjacking vulnerability affecting Mozilla Firefox, Firefox ESR, and Thunderbird. The flaw stems from a missing delay in the directory upload user interface (UI). An attacker hosting a malicious page could manipulate UI timing to trick a user into granting directory access permission without informed consent. Successful exploitation exposes the contents of a local directory to the attacker-controlled origin. The issue is categorized under [CWE-1021] Improper Restriction of Rendered UI Layers or Frames. Mozilla addressed the flaw in Firefox 131, Firefox ESR 128.3, Thunderbird 128.3, and Thunderbird 131.
Critical Impact
A remote attacker can trick users into uploading the contents of arbitrary local directories to a malicious site through UI redressing.
Affected Products
- Mozilla Firefox versions prior to 131
- Mozilla Firefox ESR versions prior to 128.3
- Mozilla Thunderbird versions prior to 128.3 and prior to 131
Discovery Timeline
- 2024-10-01 - CVE-2024-9397 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-9397
Vulnerability Analysis
The vulnerability resides in the browser's directory upload confirmation dialog. Firefox and Thunderbird present a permission prompt when a web page requests access to upload the contents of a local directory. This prompt should require deliberate user interaction to prevent accidental consent. The affected versions did not enforce an adequate delay before the confirmation control becomes actionable. An attacker can exploit this timing gap through clickjacking, in which the malicious page overlays or times UI elements so the victim's click lands on the grant button.
Because directory uploads recursively expose file contents, a successful attack can leak sensitive local data to a remote origin. The impact is limited to what the user has read access to and what the browser exposes through the upload API.
Root Cause
The root cause is the absence of an input-delay safeguard on the directory upload permission prompt. Security-sensitive dialogs typically disable action buttons for a short interval after rendering. This delay prevents automated or timed clicks from being consumed by the prompt. Without it, the prompt is vulnerable to UI redressing techniques described in [CWE-1021].
Attack Vector
Exploitation requires the victim to visit an attacker-controlled web page and perform a user action such as a click. The attacker crafts a page that triggers the directory picker at a precise moment, then overlays decoy content to redirect the user's click onto the grant button. Once permission is granted, the malicious origin receives file data for every item in the selected directory tree. See Mozilla Bug Report #1916659 for the underlying tracking discussion.
No verified public exploitation code is available for this issue.
Detection Methods for CVE-2024-9397
Indicators of Compromise
- Browser telemetry showing directory upload permission grants to unfamiliar or newly registered domains.
- Outbound HTTP POST or multipart uploads containing unexpected file trees from user profile paths.
- Web content that overlays iframes or transparent elements on top of the directory picker prompt.
Detection Strategies
- Inventory Firefox, Firefox ESR, and Thunderbird versions across the fleet and flag installations below the fixed builds.
- Monitor web proxy logs for large multipart form-data uploads originating from browser sessions to non-corporate destinations.
- Hunt for pages using framing or CSS techniques known to enable UI redressing on permission prompts.
Monitoring Recommendations
- Aggregate browser version and update status through endpoint management and security telemetry.
- Alert on outbound file uploads that deviate from baseline application behavior for end-user endpoints.
- Review Mozilla security advisories MFSA-2024-46, MFSA-2024-47, MFSA-2024-49, and MFSA-2024-50 for related fixes shipped in the same release window.
How to Mitigate CVE-2024-9397
Immediate Actions Required
- Upgrade Firefox to version 131 or later on all endpoints.
- Upgrade Firefox ESR deployments to version 128.3 or later.
- Upgrade Thunderbird to version 128.3 or 131 or later, depending on the deployed release channel.
- Verify that automatic browser updates are enabled and reaching managed devices.
Patch Information
Mozilla resolved this issue in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3 and 131. Fix details are documented in the Mozilla Security Advisory MFSA-2024-46, MFSA-2024-47, MFSA-2024-49, and MFSA-2024-50. Administrators should distribute updates through their enterprise software management platform.
Workarounds
- Educate users to reject unexpected directory upload prompts and to close pages that display them.
- Restrict browsing to trusted sites through web filtering while patch deployment is in progress.
- Disable directory upload functionality through browser policy where operationally feasible until patches are applied.
# Verify installed Firefox version on managed endpoints
firefox --version
# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Mozilla\Mozilla Firefox" /v CurrentVersion
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
