CVE-2024-32986

🎯 CVE-2024-32986 🧪 PoC 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2024-32986 | PWAsForFirefox is a tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox. Due to improper sanitization of web app properties (such as name, description, shortcuts), web apps were able to inject additional lines into XDG Desktop Entries (on Linux) and `AppInfo.ini` (on PortableApps.com). This allowed malicious web apps to introduce keys like `Exec`, which could run arbitrary code when the affected web app was launched. This vulnerabil

PWAsForFirefox is a tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox. Due to improper sanitization of web app properties (such as name, description, shortcuts), web apps were able to inject additional lines into XDG Desktop Entries (on Linux) and `AppInfo.ini` (on PortableApps.com). This allowed malicious web apps to introduce keys like `Exec`, which could run arbitrary code when the affected web app was launched. This vulnerability affects all Linux and PortableApps.com users of all PWAsForFirefox versions up to (excluding) 2.12.0. Windows and macOS users are not affected. This vulnerability has been fixed in commit `9932d4b` which has been included in release in v2.12.0. The main fix is implemented in the native part, but the extension also contains additional fixes. All Linux and PortableApps.com users are advised to update to this version as soon as possible. It is also recommended for Windows and macOS users to update to this version, as it contains additional fixes related to properties sanitization. There are no known workarounds for this vulnerability.

Klassifikation & Betroffenheit:

CWE-150CWE-74CWE-93 filips123 PWAsForFirefox < 2.12.0

Improper Neutralization of Escape, Meta, or Control Sequences

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

🛡️ Empfohlene Mitigation: Developers should anticipate that escape, meta and control characters/sequences will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-41 · Using Meta-characters in E-mail Headers … (High) CAPEC-81 · Web Server Logs Tampering (High) CAPEC-93 · Log Injection-Tampering-Forging (High) CAPEC-134 · Email Injection (Medium)

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2023-26055 10.0 CVE-2020-6932 10.0 CVE-2025-47284 9.9 CVE-2026-11362 9.8 CVE-2025-25286 9.8

🩹 Patch verfügbar (OSV):

🩹 540d87637129bbdfb218167c005a766d7e9f308c (Commit) 🩹 9932d4b289631d447f88ace09a2fabafe4cd5bd5 (Commit)

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2024

Veröffentlicht 05/2024

Heute 09.11.

CVSS-Vektor-Analyse: 9.7

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Keine

UI · Interaktion Erforderlich

S · Scope Verändert

C · Vertraulichkeit Hoch

I · Integrität Hoch

A · Verfügbarkeit Hoch

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CNA-Bewertung (GitHub_M): 9.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Veröffentlicht:03.05.2024

Aktualisiert:17.06.2026 07:30

Assigner (CNA):GitHub_M

EUVD-ID:EUVD-2024-30731

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-150 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	CVEs	Anteil
≥90 %	785	0,2 %
≥50 %	3.559	0,9 %
≥10 %	13.139	3,2 %
<10 %	396.072	95,8 %

Tier

CVEs

Anteil

≥90 %

785

0,2 %

≥50 %

3.559

0,9 %

≥10 %

13.139

3,2 %

<10 %

396.072

95,8 %

9.7 CRITICAL

EPSS

0.7%

CVE-2024-32986 🌐 Netzwerk (Remote) 🔓 Keine Authentifizierung nötig

filips123

CVE-2024-32986 | PWAsForFirefox is a tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox. Due to improper sanitization of web app properties (such as name, description, shortcuts), web apps were able to inject additional lines into XDG Desktop Entries (on Linux) and `AppInfo.ini` (on PortableApps.com). This allowed malicious web apps to introduce keys like `Exec`, which could run arbitrary code when the affected web app was launched. This vulnerabil

CWE-150 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

vor 2 Jahren ↻ vor 2 Jahren

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub