PT-2024-15683 · Facebook · Focus

James Lee · Published 2024-01-22 · Updated 2024-01-30 · CVE-2024-0605

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Focus for iOS versions prior to 122

Description The issue allows an attacker to execute unauthorized scripts on top origin sites in the urlbar by using a javascript: URI with a setTimeout race condition. This bypasses security measures, potentially leading to arbitrary code execution or unauthorized actions within the user's loaded webpage.

Recommendations For Focus for iOS versions prior to 122, update to version 122 or later to resolve the issue. As a temporary workaround, consider restricting the use of javascript: URIs in the urlbar to minimize the risk of exploitation.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2024-0605

Affected Products

Focus

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-0605 · Security Note
• https://mozilla.org/security/advisories/mfsa2024-03 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-0605 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1855575 · Note
• https://twitter.com/CVEnew/status/1749502073589170457 · Twitter Post
• https://twitter.com/l33d0hyun/status/1749503699440005583 · Twitter Post