CVE-2024-1547

What it actually does

An attacker can chain API calls and redirects to force display of a spoofed alert dialog on a victim site while showing the legitimate victim URL in the address bar.

Why it matters to the business

Users may be tricked into believing malicious content originates from a trusted site, increasing risk of phishing or social-engineering success with minimal operational disruption otherwise.

How an attack unfolds

An attacker crafts a page that initiates a sequence of API calls triggering redirects; the final redirect lands on an attacker-controlled resource that renders an alert dialog appearing to come from the original victim site URL.

How to fix it

Upgrade Firefox to 123 or later, Firefox ESR to 115.8 or later, and Thunderbird to 115.8 or later.

How to confirm the fix worked

Confirm browser and mail client versions meet or exceed the fixed releases; re-test the redirect and dialog behavior in an isolated environment using the original proof-of-concept vectors.

Typical attack path

1. Attacker hosts malicious page or link
2. Victim browser follows initial request containing crafted API sequence
3. Series of redirects occurs across domains
4. Attacker-controlled alert dialog is rendered with victim site URL visible
5. User interacts with spoofed dialog believing it is from trusted origin

How to detect it

Review browser history, redirect logs, and any recorded dialog interactions for sequences involving unexpected cross-site redirects that terminate in alert dialogs; low EPSS and absence from KEV indicate exploitation is unlikely to have occurred in the wild.

What your security team should do

• Prioritize patching Firefox, Firefox ESR, and Thunderbird instances to the fixed versions within standard change windows
• Monitor vendor advisories for any follow-on updates given the open redirect family
• Educate users on verifying dialog origins even when the URL bar appears legitimate