CVE-2024-10461

What it actually does

The vulnerability causes the browser to ignore the Content-Disposition: attachment header in multipart/x-mixed-replace responses, allowing inline rendering of content that should have been downloaded and thereby enabling cross-site scripting.

Why it matters to the business

Organizations face elevated risk of session hijacking, data theft, and unauthorized actions via XSS, with moderate urgency due to low EPSS, slight upward trend, absence from KEV, and limited downstream dependents in the listed packages.

How an attack unfolds

An attacker delivers a specially crafted multipart/x-mixed-replace response containing a Content-Disposition attachment header alongside executable script; the browser flaw causes the script to execute in the victim's context instead of triggering a download, potentially leveraged in 2024 espionage and financially motivated campaigns.

How to fix it

Upgrade affected packages to the listed fixed versions: libspring-java (Ubuntu:18.04:LTS) to 4.3.14-1, libspring-java (Ubuntu:Pro:14.04:LTS) to 3.0.6.RELEASE-13ubuntu0.1~esm2, and libspring-java (Ubuntu:Pro:16.04:LTS) to 3.2.13-5ubuntu0.1~esm1; apply vendor patches for Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132 immediately.

How to confirm the fix worked

Verify package versions match the fixed releases above, confirm the Content-Disposition attachment header now forces a download in multipart responses, and test that inline script execution is blocked.

Typical attack path

1. Attacker identifies a target application returning multipart/x-mixed-replace responses
2. Attacker crafts a response that includes malicious script and a Content-Disposition: attachment header
3. Victim browser processes the response and renders the content inline due to the flaw
4. Malicious script executes in the user's session context
5. Attacker uses the resulting XSS to steal data or perform actions on behalf of the user

How to detect it

Review web server and browser logs for multipart/x-mixed-replace responses that contain both attachment disposition headers and unexpected script execution; correlate with known threat actor patterns from 2024 campaigns.

What your security team should do

• Apply the exact fixed package versions for libspring-java on all listed Ubuntu releases within 30 days
• Monitor EPSS trend and threat actor activity for any increase in exploitation attempts
• Enable strict content disposition handling and CSP headers as compensating controls
• Scan logs for unexpected inline rendering of attachment content