CVE-2024-4772

What it actually does

HTTP digest authentication nonce values generated via rand() produce predictable outputs, enabling attackers to anticipate nonces and craft valid authentication responses.

Why it matters to the business

Affected browser users face elevated risk of authentication bypass, potentially exposing protected web resources and user sessions to unauthorized access.

How an attack unfolds

An attacker monitors digest authentication exchanges, predicts future nonce values based on the weak random source, and forges replayable responses to authenticate without valid credentials.

How to fix it

Upgrade affected Firefox installations to version 126 or later to replace the weak nonce generation with a cryptographically secure implementation.

How to confirm the fix worked

Confirm deployed Firefox versions are 126 or newer; perform targeted authentication tests to verify nonce unpredictability under repeated requests.

Typical attack path

1. Capture digest authentication requests containing nonces
2. Analyze rand() output patterns to predict subsequent nonces
3. Compute valid digest responses for predicted nonces
4. Replay forged responses to bypass authentication

How to detect it

Examine web server access logs for repeated authentication attempts with varying nonces or unexpected success rates following observed requests; correlate with client browser version data.

What your security team should do

• Immediately deploy Firefox 126 or later across all managed endpoints
• Review web server authentication logs for anomalous success patterns
• Consider temporary network-level controls on digest auth endpoints until patches are applied