CVE-2023-29539

What it actually does

Improper handling of NULL characters in the filename directive of the Content-Disposition header causes filename truncation, enabling reflected file download attacks that can deliver malware under a misleading name.

Why it matters to the business

Users across the organization may be tricked into executing malware, leading to endpoint compromise, data loss, or further lateral movement with minimal warning from download prompts.

How an attack unfolds

An attacker hosts or reflects content with a crafted Content-Disposition header containing a filename such as "payload.exe%00.pdf"; the browser truncates at the NULL byte and presents only "payload.exe" to the user for download and execution.

How to fix it

Upgrade Mozilla Firefox to version 112 or later, Firefox ESR to 102.10 or later, Firefox for Android to 112 or later, Focus for Android to 112 or later, and Thunderbird to 102.10 or later. Apply updates via the product's built-in updater or package manager as soon as possible.

How to confirm the fix worked

Verify installed versions against the fixed releases listed above; test header handling with a synthetic Content-Disposition response containing a NULL byte and confirm the full filename is preserved without truncation.

Typical attack path

1. Attacker crafts a malicious link, email, or web response embedding a Content-Disposition header with NULL byte in the filename
2. Victim is lured to the resource via phishing or compromised site
3. Browser processes the header and truncates the filename at the NULL character
4. Victim is prompted to save or open a file with a benign-looking extension
5. Victim executes the downloaded content, installing malware

How to detect it

Review browser download logs and proxy records for files whose original Content-Disposition filenames contain embedded NULL characters or unexpected truncation; correlate with subsequent execution of renamed executables.

What your security team should do

• Prioritize patching all affected Mozilla products within the next 48 hours given the high CVSS and potential for malware delivery
• Enable automatic updates for Firefox, ESR, Thunderbird, and Android variants across the fleet
• Block or monitor outbound downloads of executable files from untrusted domains
• Educate users on verifying file extensions before execution