CVE-2024-2610

What it actually does

Markup injection allows an attacker to extract nonce values used in content security policies, enabling bypass of strict CSP protections in affected browser and mail client versions.

Why it matters to the business

Attackers could inject malicious scripts that evade security controls, potentially leading to data theft or unauthorized actions within user sessions across widely deployed client software with no ransomware linkage or known exploitation campaigns.

How an attack unfolds

An attacker crafts and delivers markup content containing injection payloads to a target using the vulnerable client; the injection extracts CSP nonce values which are then used to load unauthorized scripts that would otherwise be blocked.

How to fix it

Upgrade kernel-rpm-macros to version 129-1.el8.alma or later and redhat-rpm-config to version 129-1.el8.alma or later on AlmaLinux 8 systems; apply equivalent updates for Firefox to 124 or later, Firefox ESR to 115.9 or later, and Thunderbird to 115.9 or later.

How to confirm the fix worked

Verify client versions meet or exceed the fixed releases, review CSP implementations for proper nonce handling, and test content rendering with injected markup to confirm nonces are no longer exposed.

Typical attack path

1. Identify a target using an unpatched vulnerable client version
2. Deliver crafted markup via email, web page, or other content channel
3. Trigger injection to extract nonce values from the content security policy
4. Use stolen nonces to inject and execute unauthorized scripts bypassing CSP

How to detect it

Review web and email logs for unusual markup patterns or repeated nonce-related requests; examine client process behavior for unexpected script execution after content rendering; no known threat actors or ransomware usage associated with this issue.

What your security team should do

• Prioritize patching all instances of the affected clients to the specified fixed versions
• Monitor for any new exploit maturity indicators given the stable low EPSS score
• Review content security policies to ensure nonces and other controls remain effective post-update