CVE-2023-4581

What it actually does

Firefox and Thunderbird lacked a blocklist entry for Excel .xll add-in files, permitting them to download without executable warnings or blocks.

Why it matters to the business

Organizations face elevated risk of users inadvertently obtaining and opening malicious Excel add-ins that can execute code, increasing malware exposure across the workforce.

How an attack unfolds

An attacker places a malicious .xll file on a website or phishing link; a user browsing with an affected Firefox or Thunderbird version downloads the file without any security warning, then opens it in Excel to trigger payload execution.

How to fix it

Upgrade Firefox to version 117 or later, Firefox ESR to 102.15 or 115.2 or later, and Thunderbird to 102.15 or 115.2 or later. Maintain current versions to ensure executable blocklist coverage.

How to confirm the fix worked

Confirm browser versions meet or exceed the fixed releases listed above and test that .xll downloads now trigger appropriate executable warnings.

Typical attack path

1. Attacker hosts or links to a malicious .xll file
2. Victim uses vulnerable Firefox or Thunderbird to visit the page or click the link
3. Browser downloads the .xll without warning or block
4. Victim opens the .xll in Microsoft Excel
5. Excel executes the embedded code or payload

How to detect it

Review web proxy, browser download, and endpoint logs for .xll file transfers; correlate with subsequent Excel process launches or unexpected macro/add-in activity.

• .xll file downloads from external sources
• Excel.exe launching after recent .xll file creation

What your security team should do

• Prioritize updating all Firefox and Thunderbird instances to the minimum fixed versions
• Enable enterprise update policies or use management tools to enforce rapid deployment
• Educate users on verifying file types before opening downloaded add-ins
• Monitor for any .xll file downloads from untrusted sources via proxy or endpoint logs