CVE-2024-9399: Mozilla Firefox DOS Vulnerability

CVE-2024-9399 Overview

CVE-2024-9399 is a denial of service vulnerability affecting Mozilla Firefox and Thunderbird. A malicious website can initiate a specially crafted WebTransport session that crashes the Firefox process, terminating the browser and any active sessions. The issue is classified under [CWE-404] Improper Resource Shutdown or Release.

The vulnerability affects Firefox versions earlier than 131, Firefox ESR earlier than 128.3, and Thunderbird versions earlier than 128.3 and 131. Exploitation requires no authentication, no user interaction beyond visiting a malicious page, and can be triggered remotely over the network.

Critical Impact
Remote attackers can crash the Firefox or Thunderbird process without authentication or user interaction by hosting a malicious WebTransport endpoint.

Affected Products

Mozilla Firefox versions earlier than 131
Mozilla Firefox ESR versions earlier than 128.3
Mozilla Thunderbird versions earlier than 128.3 and 131

Discovery Timeline

2024-10-01 - CVE-2024-9399 published to NVD
2025-03-14 - Last updated in NVD database

Technical Details for CVE-2024-9399

Vulnerability Analysis

The vulnerability resides in Firefox's WebTransport implementation. WebTransport is a web API that provides bidirectional, low-latency communication between a client and server over HTTP/3. The flaw allows a remote server to construct a WebTransport session with malformed or unexpected parameters that the Firefox process cannot handle, causing a process crash.

The vulnerability is tracked in Mozilla Bug #1907726 and addressed in advisories MFSA-2024-46, MFSA-2024-47, MFSA-2024-49, and MFSA-2024-50. The EPSS score is 0.26% with a 49.5 percentile, indicating limited observed exploitation interest. No public proof-of-concept code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper resource shutdown or release [CWE-404] within Firefox's WebTransport session handling logic. When the browser receives a specially crafted session initiation, resource management fails, resulting in process termination rather than graceful error handling.

Attack Vector

The attack vector is network-based. An attacker hosts a website configured to initiate a malicious WebTransport session. When a victim browses to that site using a vulnerable Firefox or Thunderbird version, the application establishes the WebTransport session and crashes. The attack requires no credentials and no privileged interaction beyond loading the attacker-controlled page.

The vulnerability mechanism is described in the Mozilla Bug Report #1907726. Synthetic exploit code is not available, and no verified proof-of-concept has been published.

Detection Methods for CVE-2024-9399

Indicators of Compromise

Unexpected Firefox or Thunderbird process crashes shortly after navigation to an external website
Crash reports referencing WebTransport, HTTP/3, or QUIC session handling components
Outbound HTTP/3 (QUIC over UDP port 443) connections to unfamiliar domains preceding browser termination

Detection Strategies

Inventory Firefox and Thunderbird versions across managed endpoints and compare against patched releases (Firefox 131, Firefox ESR 128.3, Thunderbird 128.3/131)
Correlate browser process exit codes with preceding network connections to detect crash patterns tied to external sites
Review Mozilla crash telemetry submissions for repeated WebTransport-related signatures

Monitoring Recommendations

Monitor endpoint telemetry for abnormal Firefox or Thunderbird termination events using EDR process logs
Track outbound QUIC traffic from browsers to identify unusual WebTransport destinations
Alert on repeated browser restarts on a single host within short time windows, which may indicate targeted DoS

How to Mitigate CVE-2024-9399

Immediate Actions Required

Upgrade Firefox to version 131 or later on all endpoints
Upgrade Firefox ESR to version 128.3 or later for enterprise deployments
Upgrade Thunderbird to version 128.3 or 131 or later across all user mailboxes
Restart browser and mail client processes after applying updates to ensure patched binaries are loaded

Patch Information

Mozilla released fixes documented in MFSA-2024-46, MFSA-2024-47, MFSA-2024-49, and MFSA-2024-50. Apply the corresponding updates for each affected product line. Enterprise administrators should use Mozilla's enterprise deployment tooling or operating system package managers to roll out fixed versions.

Workarounds

Disable WebTransport in Firefox by setting network.webtransport.enabled to false in about:config until the patch is applied
Block outbound HTTP/3 (UDP 443) traffic at the perimeter for browsers that do not require WebTransport functionality
Restrict browsing to trusted sites via web proxy policies if rapid patching is not feasible

bash

# Configuration example: disable WebTransport via Firefox enterprise policy (policies.json)
{
  "policies": {
    "Preferences": {
      "network.webtransport.enabled": {
        "Value": false,
        "Status": "locked"
      }
    }
  }
}