CVE-2024-8383

What it actually does

The browser skips confirmation prompts for news: and snews: URI schemes, allowing any registered application to be invoked without user approval.

Why it matters to the business

Attackers can trick users into installing malicious handlers that execute automatically when visiting attacker-controlled pages, leading to potential compromise of user systems and data.

How an attack unfolds

An attacker registers a malicious application as a handler for news: or snews: schemes on the victim's system, then serves content that triggers the scheme from a website the user visits, launching the malicious application without confirmation.

How to fix it

Upgrade Firefox to version 130 or later, Firefox ESR to 128.2 or later, and Firefox ESR to 115.15 or later. For the affected Go package github.com/woodpecker-ci/woodpecker upgrade to 0.15.1 or later.

How to confirm the fix worked

Verify browser version numbers match or exceed the fixed releases and confirm that attempts to invoke unsupported schemes now trigger confirmation dialogs.

Typical attack path

1. User downloads and installs an application that registers itself for news: or snews: schemes
2. Attacker-controlled website invokes a news: or snews: URI
3. Browser launches the registered malicious handler without prompting the user
4. Malicious application executes with user privileges

How to detect it

Review browser process creation logs and application launch events for invocations of news: or snews: schemes without prior user confirmation; inspect installed protocol handlers for unexpected entries.

What your security team should do

• Prioritize patching all Firefox instances to the fixed versions immediately due to the low-effort exploitation path
• Monitor for unexpected application launches triggered by browser scheme handlers
• Educate users on risks of installing applications from untrusted sources that may register URI handlers