CVE-2023-23604

What it actually does

A duplicate SystemPrincipal object could be created when parsing a non-system html document via DOMParser::ParseFromSafeString, allowing bypass of web security checks.

Why it matters to the business

Attackers could bypass browser security mechanisms in affected versions, risking unauthorized actions or data exposure for users until patched; low EPSS and no KEV status indicate limited observed exploitation but still requires prompt attention given 1232 days since publication.

How an attack unfolds

An attacker supplies a specially crafted non-system HTML document to DOMParser::ParseFromSafeString in vulnerable Firefox versions, triggering creation of a duplicate SystemPrincipal that evades intended security checks.

How to fix it

Upgrade Firefox to version 109 or later. For gravitl/netmaker (GIT) update to commit 1621c27c1d176b639e9768b2acad7693e387fd51.

How to confirm the fix worked

Confirm Firefox version is 109 or higher; verify the gravitl/netmaker commit hash 1621c27c1d176b639e9768b2acad7693e387fd51 is deployed and test that DOMParser parsing no longer produces duplicate principals.

Typical attack path

1. Deliver malicious HTML via web page or file
2. Trigger parsing through DOMParser::ParseFromSafeString
3. Exploit duplicate SystemPrincipal to bypass checks
4. Perform actions that should have been blocked

How to detect it

Review browser logs and crash reports for anomalies around DOMParser usage; check for unexpected principal handling artifacts in memory dumps or audit trails from affected versions.

What your security team should do

• Prioritize patching Firefox instances to 109+ immediately
• Update gravitl/netmaker to the specified commit across all deployments
• Monitor for any post-patch anomalies in browser security behavior