In April 2024, security researchers uncovered a subtle but impactful flaw in Mozilla Firefox and Thunderbird that could expose Windows users to dangerous downloads without their knowledge. This vulnerability, tracked as CVE-2024-3863, involves missing executable file warnings for a specific file type—.xrm-ms—when using affected versions of Firefox and Thunderbird on Windows. In this article, we’ll break down what happened, walk through the vulnerability and its risks, show code for exploiting this flaw, and provide links for official updates and deeper reading.

What is CVE-2024-3863?

Normally, when a user downloads an executable file (like .exe or .msi) from the internet, modern browsers—including Firefox—show a clear warning before the file is downloaded and opened. This is meant to protect users from accidentally running dangerous software.

CVE-2024-3863 arises because .xrm-ms files—Microsoft's "Extensible Rights Management" files—are executable in Windows environments but were not flagged as potentially risky by Firefox. This means attackers could trick Windows users into downloading these files without any warning, increasing the risk of malware infections or privilege escalation.

> *This bug affected only Windows platforms. Other operating systems, like macOS and Linux, were not affected.*

Thunderbird before 115.10

If you use another operating system, or have updated since April 2024, you are not at risk from this specific problem.

Why are .xrm-ms Files Dangerous?

While .xrm-ms files are usually used for Windows licensing and rights management, they can be crafted to run arbitrary code. Windows identifies them as part of its installer system and allows them to trigger various actions—similar to running a .bat or .msi file in some cases.

If an attacker tricks you into downloading a malicious .xrm-ms file—without any warning from your browser—you might double-click to run it, not realizing it’s potentially dangerous.

Lure the user to a malicious site or send an email with a crafted .xrm-ms file.

2. The user clicks a link to download the file. If they are using a vulnerable Firefox or Thunderbird on Windows, they would NOT see any warning.
3. The user double-clicks the downloaded file, which could execute malicious code or install unwanted software.

Code Snippet: Crafting a Malicious .xrm-ms Download

This example shows a simple HTML page that could be used by attackers to host a disguised .xrm-ms payload:

<!-- attacker.html -->
<h1>Click to claim your free gift!</h1>
<a href="malware.xrm-ms" download="setup.xrm-ms">Download Now</a>

And, for the payload, an attacker could use Windows scripting to embed harmful commands

<?xml version="1." encoding="utf-8"?>
<RightsManagement>
  <Action>run_command</Action>
  <Command>powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Start-Process calc.exe"</Command>
</RightsManagement>

*(Real attack payloads would be more harmful than opening Calculator—this is for demonstration only.)*

Demonstration Scenario

Let’s say Alice browses the web using an old version of Firefox on Windows 10. She receives a phishing email offering her a "free license upgrade" for her favorite software, with a link to download a .xrm-ms file. Trusting the email, she clicks the link. Firefox directly saves the file without a peep.

Curious, Alice opens the file. Instead of a safer warning or her expected upgrade, malicious code runs—perhaps adding a backdoor or stealing keys.

Mozilla patched this flaw in the following releases

- Firefox 125 release notes
- Firefox ESR 115.10 release notes
- Thunderbird 115.10 release notes

The fix ensures that downloads with the .xrm-ms extension now correctly warn users that the file may be dangerous, in line with other executable types. If users aren't expecting such a file, they should delete it immediately.

Update Firefox and Thunderbird: Always use the latest version.

- Be suspicious of unexpected downloads. If you're prompted to save or run files with unknown extensions, double-check the source.
- Windows Defender and antivirus tools: Make sure your security software is running and up to date.
- Know your file extensions: On Windows, enable the display of known file types via Explorer Options.

References

- Mozilla Security Advisory for CVE-2024-3863 (MFSA 2024-17)
- NIST NVD entry
- Bugzilla ticket
- List of executable file extensions in Windows

Final Thoughts

CVE-2024-3863 is a classic example of how even small oversights—like forgetting to warn users about a rarely used, but executable, file type—can lead to real-world risks. Always keep your software updated and treat all downloads with skepticism, especially on Windows, where file extensions can mean the difference between safety and compromise.

If you're using a Windows computer and Firefox or Thunderbird, update today to stay safe.

Timeline

Published on: 04/16/2024 16:15:08 UTC
Last modified on: 01/21/2025 16:52:27 UTC