CVE-2023-23602

What it actually does

Mishandled security check allows WebSocket creation inside WebWorkers to bypass the connect-src directive of Content Security Policy, enabling connections to origins that should be restricted.

Why it matters to the business

Organizations relying on older browser deployments face increased risk of unauthorized network connections from web content, potentially leading to data leakage or policy violations in environments that use strict content security controls.

How an attack unfolds

An attacker hosts malicious web content that loads a WebWorker; the worker creates a WebSocket to a restricted origin; because the CSP check is skipped, the connection succeeds despite policy restrictions, allowing further actions such as data exfiltration or command-and-control communication.

How to fix it

Upgrade Mozilla Firefox to version 109 or later, Firefox ESR to 102.7 or later, and Thunderbird to 102.7 or later. Where upgrades are delayed, enforce strict CSP on all web applications and consider browser isolation or blocking of WebWorker usage for high-risk sites.

How to confirm the fix worked

Confirm installed browser versions meet or exceed the fixed releases; test affected pages with a connect-src policy and verify that WebSocket attempts from WebWorkers are now blocked; review CSP reports for any unexpected connect-src violations.

Typical attack path

1. Victim visits attacker-controlled or compromised web page
2. Page spawns a WebWorker
3. Worker attempts WebSocket connection to an origin blocked by connect-src
4. Security check is bypassed and connection is established
5. Attacker uses the channel for unauthorized actions

How to detect it

Review browser version inventory to identify unpatched instances; examine web server or proxy logs for WebSocket connections that violate expected CSP origins; inspect CSP violation reports for entries originating from worker contexts.

What your security team should do

• Prioritize browser updates across all managed endpoints within standard patch windows
• Audit web applications for reliance on connect-src and ensure policies remain effective after updates
• Monitor vendor advisories for any follow-on fixes in related Mozilla products