CVE-2024-31392: 
NixOS vulnerability analysis and mitigation

CVE-2024-31392 is a security vulnerability affecting Firefox for iOS versions below 124. The vulnerability was discovered by Chaykin Artem and disclosed on April 2, 2024. The issue occurs when Firefox fails to properly update the security indicator in the browser's interface when insecure elements are dynamically added to a secure page (Mozilla Advisory).

The vulnerability stems from a timing issue where if an insecure element (such as an HTTP image or form) is added to an HTTPS page after a delay, Firefox would not replace the secure icon with a mixed content security status. This occurs even though the content is actually loaded insecurely, creating a discrepancy between the actual security state and what is displayed to the user. The vulnerability has been assigned a CVSS 3.1 Base Score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (NVD).

The impact of this vulnerability is rated as low by Mozilla. While the browser correctly loads the content insecurely, it fails to properly inform users about the mixed content state, potentially leading users to believe their connection is fully secure when parts of the page are actually loaded over insecure channels (Mozilla Advisory).

The vulnerability can be triggered when a webpage dynamically adds insecure content (such as HTTP images or forms) after a delay of approximately one second. This affects the browser's security indicator, which fails to update properly to reflect the mixed content state (Mozilla Bug).

The vulnerability has been fixed in Firefox for iOS version 124. Users are advised to update to this version or later to receive the security fix (Mozilla Advisory).