CVE-2024-6612

What it actually does

CSP violation messages in the developer tools console generate hyperlinks to the offending resource, triggering an unintended DNS prefetch that discloses the occurrence of the violation to observers on the network.

Why it matters to the business

Attackers can learn that a web application's content security policy is being triggered, providing reconnaissance value that may aid further targeted attacks against users or sites.

How an attack unfolds

An attacker crafts a page or resource that deliberately violates the victim's CSP, then monitors for the resulting DNS prefetch queries that are generated when the developer tools console renders the violation link.

How to fix it

Upgrade Firefox to version 128 or later and Thunderbird to version 128 or later. Disable or restrict developer tools access where feasible in high-risk environments until patches are applied.

How to confirm the fix worked

Confirm browser and mail client versions are at least 128; reproduce a CSP violation with developer tools open and verify no DNS prefetch occurs for the violation link.

Typical attack path

1. Trigger a CSP violation in the target browser
2. Ensure developer tools console is open or will be opened
3. Observe or intercept the DNS prefetch request for the violating resource URL
4. Correlate the prefetch with the timing of the violation to confirm policy enforcement

How to detect it

Inspect DNS query logs for prefetch requests to resource URLs that appear only in developer console violation messages; correlate with web server logs showing CSP violation reports.

What your security team should do

• Prioritize patching Firefox and Thunderbird instances to version 128+ within standard change windows
• Review CSP policies for overly broad directives that may generate frequent violations
• Monitor network logs for unexpected DNS queries to internal or application resource domains from client browsers