CVE-2024-11697

What it actually does

Bypasses the 'Open Executable File?' confirmation dialog when handling keypress events, allowing execution of malicious code without user consent.

Why it matters to the business

Attackers can run unauthorized programs on user systems, leading to data theft, ransomware deployment, or further network compromise, especially in environments with high browser usage.

How an attack unfolds

An attacker crafts a malicious page or email that triggers specific keypress events to suppress the confirmation dialog, tricking the browser into executing a downloaded executable file directly.

How to fix it

Upgrade Firefox to version 133 or later, Firefox ESR to 128.5 or later, Thunderbird to 133 or later, and Thunderbird ESR to 128.5 or later. Apply the listed fixed versions for affected imagemagick packages on Ubuntu 14.04 and 16.04 where applicable.

How to confirm the fix worked

Verify browser and email client versions meet or exceed the fixed releases; test dialog behavior with crafted keypress events in a controlled environment to confirm the prompt is enforced.

Typical attack path

1. Deliver malicious content via web page or email attachment
2. Trigger keypress event handling to suppress dialog
3. Bypass confirmation prompt for executable file
4. Execute malicious code on the victim system

How to detect it

Review browser download logs and process creation events for unexpected executable launches immediately following web or email interactions; correlate with user activity around the time of keypress-related events.

What your security team should do

• Prioritize immediate updates to Firefox 133+, ESR 128.5+, Thunderbird 133+, and ESR 128.5+ across all endpoints
• Monitor EPSS and threat actor activity for any increase in exploitation attempts
• Enforce application allow-listing to limit executable execution from browser downloads