CVE-2024-7525: 
NixOS vulnerability analysis and mitigation

CVE-2024-7525 is a security vulnerability discovered in Mozilla products that affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14. The vulnerability was disclosed on August 6, 2024, and involves a permission control issue where web extensions with minimal permissions could create a StreamFilter to read and modify response bodies of requests on any site (Mozilla Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 8.1 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. The technical issue stems from a missing permission check in the StreamFilter functionality, which allowed web extensions to bypass intended security restrictions. The vulnerability was reported by security researcher Rob Wu (NVD).

The vulnerability allows web extensions with minimal permissions to read and modify the response body of requests on any site, potentially leading to unauthorized access to sensitive information and the ability to modify web content. This could enable malicious extensions to intercept and manipulate web traffic beyond their intended permissions scope (Mozilla Advisory).

The vulnerability requires user interaction and can be exploited through a network vector. While specific exploit details are not publicly available, the vulnerability has been rated with low attack complexity, requiring no privileges for exploitation (NVD).

Mozilla has addressed this vulnerability by releasing security updates in Firefox 129, Firefox ESR 115.14, Firefox ESR 128.1, Thunderbird 128.1, and Thunderbird 115.14. Users are advised to update their installations to these or later versions to mitigate the risk (Mozilla Advisory).