CVE-2024-0753

What it actually does

The flaw allows an attacker to bypass HSTS enforcement on a subdomain under specific configuration conditions, permitting HTTP connections where HTTPS should be required.

Why it matters to the business

Organizations relying on these browsers face increased risk of traffic interception or tampering on affected subdomains, potentially exposing sensitive data or enabling phishing without raising user warnings.

How an attack unfolds

An attacker identifies a subdomain with the vulnerable HSTS setup, crafts a scenario to trigger the bypass, and serves malicious content over HTTP to intercept or manipulate traffic that should have been protected.

How to fix it

Upgrade Mozilla Firefox to version 122 or later, Firefox ESR to 115.7 or later, and Thunderbird to 115.7 or later. Apply updates across all managed endpoints as soon as possible.

How to confirm the fix worked

Verify installed browser versions meet or exceed the fixed releases; test HSTS behavior on subdomains with the previously vulnerable configuration to confirm enforcement.

Typical attack path

1. Identify a subdomain affected by the specific HSTS configuration
2. Trigger the HSTS bypass condition via crafted navigation or resource load
3. Serve or redirect to HTTP content on the subdomain
4. Intercept or modify traffic that should have used HTTPS

How to detect it

Examine browser logs or proxy records for unexpected HTTP requests to subdomains that should enforce HSTS; look for patterns of mixed-content loads or missing upgrade headers in historical traffic.

What your security team should do

• Prioritize deployment of the fixed browser versions to all users
• Monitor for any remaining unpatched instances in the environment
• Review HSTS configurations on subdomains for defense-in-depth