CVE-2024-0747

What it actually does

A parent page's Content Security Policy can override a child iframe's CSP when unsafe-inline is present, allowing the parent policy to dictate script execution rules for the child frame and bypassing intended restrictions on inline code.

Why it matters to the business

Attackers may inject and execute unauthorized scripts in web content viewed by users, leading to integrity violations, potential data manipulation, or follow-on attacks without user interaction beyond normal browsing.

How an attack unfolds

An attacker hosts a parent page containing an iframe that loads attacker-controlled content. The parent's CSP includes unsafe-inline, which due to the flaw overrides the child's stricter policy, permitting execution of malicious inline scripts that would otherwise be blocked.

How to fix it

Upgrade Firefox to version 122 or later, Firefox ESR to 115.7 or later, and Thunderbird to 115.7 or later. Apply vendor patches promptly; no configuration workaround fully mitigates the issue.

How to confirm the fix worked

Confirm browser versions meet or exceed the fixed releases listed by the vendor. Test CSP behavior with parent-child iframe scenarios using unsafe-inline to verify policy isolation is enforced.

Typical attack path

1. Attacker prepares a parent webpage embedding a target iframe with unsafe-inline in its CSP
2. Victim browser loads the parent page, triggering the flawed CSP inheritance to the child frame
3. Malicious inline scripts execute in the child context despite the child's intended CSP
4. Attacker achieves script execution for data exfiltration or further exploitation

How to detect it

Review browser process logs and CSP violation reports for unexpected policy overrides in iframe contexts; examine network captures for parent pages serving CSP headers with unsafe-inline alongside child frames.

What your security team should do

• Prioritize browser updates across all endpoints given the remote attack vector and integrity impact
• Monitor vendor advisories for any related CSP or iframe handling changes
• Review web application CSP deployments to reduce reliance on unsafe-inline where possible