1351722 - Possible content injection via console leading to code execution

Status: RESOLVED DUPLICATE of bug 1319080

(Firefox :: Untriaged, defect)

Description

[dkdmd18]

Attachment: firefox.JPG

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Steps to reproduce:

on version 52 of firefox, I was trying the harleem shake xss and also trying to launch executables from my windows directory in the inspect element window-> console

The payload I entered is: f=Components.classes['@mozilla.org/file/local;1'].createInstance(Components.interfaces.nsILocalFile);f.initWithPath('c:\\Windows\\System32\\calc.exe');f.launch()



Actual results:

The calculator executable popped up after i hit run in the console


Expected results:

The executable file should not have blindly been executed and the action should have been blocked.

Comment 1

[:Gijs (he/him)]

The screenshot is using Firebug, but there's a dupe for the same issue in the builtin console.

If you think this is a problem in Firebug, please file a bug in Firebug's bugtracker (not this one).