CVE-2023-23598

What it actually does

A website can read arbitrary local files by abusing drag-and-drop data handling in the GTK wrapper, where text/plain MIME data containing file URLs is misinterpreted as a drag operation, allowing DataTransfer.setData to expose file contents.

Why it matters to the business

Attackers can steal sensitive user files from visitors to malicious sites, resulting in unauthorized data disclosure and potential loss of confidential information.

How an attack unfolds

An attacker hosts a webpage that uses the DataTransfer API to set drag data as text/plain containing file: URLs. When a user interacts with the page on a vulnerable GTK-based Firefox build, the browser permits the site to read and exfiltrate the referenced local files.

How to fix it

Upgrade Mozilla Firefox to 109 or later, Firefox ESR to 102.7 or later, and Thunderbird to 102.7 or later.

How to confirm the fix worked

Confirm installed versions meet or exceed the fixed releases and test that drag-and-drop operations from untrusted pages no longer expose local file contents.

Typical attack path

1. User visits a malicious website controlled by the attacker
2. Page initiates a drag operation with crafted text/plain MIME data containing file URLs
3. GTK wrapper mishandles the data and grants read access via DataTransfer
4. Attacker retrieves file contents and exfiltrates them over the network

How to detect it

Examine browser history and process logs for visits to suspicious domains coinciding with unexpected outbound file transfers; look for anomalous DataTransfer API usage in web content.

What your security team should do

• Immediately update all affected Mozilla products to the fixed versions
• Block or monitor access to high-risk websites until patches are deployed
• Review browser update policies to ensure timely application of security fixes