CVE-2024-10462

What it actually does

Truncation of a long URL could have allowed origin spoofing in a permission prompt, bypassing authorization checks.

Why it matters to the business

Attackers could obtain unauthorized permissions by spoofing website origins, potentially leading to data exposure or unauthorized actions on affected systems; low urgency as the issue is not known to be exploited in ransomware campaigns and has minimal EPSS score with slight upward trend.

How an attack unfolds

An attacker crafts a specially formatted long URL that truncates in the permission prompt to display a spoofed origin; the user is tricked into granting permissions believing the request comes from a trusted site, as seen in 2024 zero-day exploitation campaigns by espionage and financially motivated actors.

How to fix it

Upgrade affected products to fixed versions: libreoffice (Ubuntu:14.04:LTS) to 1:4.2.8-0ubuntu3; apply equivalent updates for Firefox to 132 or later, Firefox ESR to 128.4 or later, and Thunderbird to 128.4 or later.

How to confirm the fix worked

Verify installed versions match or exceed the fixed releases listed; test permission prompts with long URLs to confirm origin display is no longer truncated or spoofable.

Typical attack path

1. Craft a malicious long URL designed to truncate and spoof an origin
2. Trigger a permission prompt in the affected application
3. User grants the permission under the false origin assumption
4. Attacker abuses the granted permission for further access or actions

How to detect it

Examine application logs for permission prompt events involving unusually long URLs or mismatched origins; review audit trails for unexpected permission grants potentially linked to espionage or financial campaigns.

What your security team should do

• Prioritize patching LibreOffice and Mozilla products to the specified fixed versions within standard maintenance windows
• Review and audit recent permission grants in affected applications for anomalies
• Monitor EPSS trend and threat actor reports for any increase in exploitation activity