CVE-2018-18506

What it actually does

When proxy auto-detection loads a PAC file, the file can instruct the browser to forward localhost requests through an external proxy, bypassing the manual-proxy restriction that blocks such loops.

Why it matters to the business

Attackers can reach and potentially compromise internal services or developer tools that listen only on localhost if users browse while the malicious PAC is active, increasing exposure for organizations that rely on local-only network listeners.

How an attack unfolds

An attacker hosts or supplies a PAC file that maps localhost destinations to an attacker-controlled proxy; a user enables proxy auto-detection or loads the PAC locally in an affected Firefox version, after which requests intended for localhost services are sent externally, allowing the attacker to interact with those services.

How to fix it

Upgrade Mozilla Firefox to version 65 or later on all affected systems; disable proxy auto-detection where feasible until patches are applied; review and restrict any localhost-bound services that may be reachable via browser traffic.

How to confirm the fix worked

Confirm Firefox version is 65 or newer; test that manually configured proxies still block localhost forwarding and that auto-detected PAC files cannot override this behavior; verify no unexpected proxy configuration files are present in user profiles.

Typical attack path

1. Craft or host a malicious PAC file that redirects localhost traffic
2. Trick the victim into enabling proxy auto-detection or loading the PAC file in Firefox
3. Victim browses while the PAC is active, causing localhost-bound requests to be proxied externally
4. Attacker receives and interacts with traffic intended for local services

How to detect it

Review browser proxy configuration logs and PAC file load events for unexpected entries; inspect network traffic from browser processes for connections to localhost ports routed externally; check user profile directories for recently added PAC files.

What your security team should do

• Prioritize browser updates across the fleet given the multi-year window since disclosure
• Audit environments for localhost-only services accessed via browsers and apply network segmentation
• Disable PAC auto-detection in managed Firefox configurations unless explicitly required
• Monitor for unusual outbound connections from browser processes to internal service ports