CVE-2024-2611: 
NixOS vulnerability analysis and mitigation

A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permissions. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9. The issue was discovered by researcher Hafiizh and assigned CVE-2024-2611 with a moderate severity rating (Mozilla Advisory, NVD).

The vulnerability stems from a missing delay implementation when pointer lock was used in conjunction with permission prompts. The issue could be exploited by using pointerlock before the permission prompt appeared, causing the cursor to disappear and reappear, which enabled clickjacking. The vulnerability has a CVSS v3.1 Base Score of 5.5 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) (NVD).

If exploited, this vulnerability could allow a malicious website to trick users into granting permissions they did not intend to grant through clickjacking techniques. This could potentially lead to unauthorized access to system resources or features that normally require explicit user consent (Mozilla Advisory).

The vulnerability requires user interaction and can be exploited remotely through a malicious webpage. A proof of concept was demonstrated showing that the issue could be triggered by performing multiple clicks with specific timing on a crafted webpage (Mozilla Bug).

The vulnerability has been fixed in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. Users are advised to update their software to these versions or later. The fix involves implementing proper delay handling when pointer lock is used in conjunction with permission prompts (Mozilla Advisory, Debian Advisory).