CVE-2023-23603: 
NixOS vulnerability analysis and mitigation

A security vulnerability identified as CVE-2023-23603 was discovered in Firefox's console.log functionality. The vulnerability affects Firefox versions prior to 109, Thunderbird versions before 102.7, and Firefox ESR versions before 102.7. The issue was disclosed on January 17, 2023, and was reported by Dan Veditz (Mozilla Advisory).

The vulnerability stems from inadequate filtering of style directives in console.log calls. Specifically, the regular expressions used to filter out forbidden properties and values from style directives weren't properly accounting for external URLs. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (NVD).

The vulnerability could allow attackers to potentially exfiltrate data from the browser by bypassing Content Security Policy (CSP) restrictions. This could lead to unauthorized data access and potential information disclosure (Mozilla Advisory, Mozilla Bug).

The vulnerability was fixed in Firefox 109, Firefox ESR 102.7, and Thunderbird 102.7. The fix involved explicitly allowing only data URLs in cleanupStyle and improving the filtering mechanism for style directives. Users are advised to upgrade to these versions or later to mitigate the vulnerability (Mozilla Advisory, Mozilla Bug).