1615471 - (CVE-2020-12393) Command injection in the "Copy as cURL (Windows)" feature

Status: VERIFIED FIXED

(DevTools :: Netmonitor, task, P1)

Description

[david.yesland]

Attachment: example_POC.html

Firefox does not perform any kind of escaping on $ characters in the "Copy as cURL (Windows)" functionality. This allows a PowerShell subexpression to be used in the copied cURL command, which if pasted into PowerShell will lead to command injection. This would be possible by creating a request which contains the $() characters in any portion which does not get URL encoded.

For example, the following code snippet with create a request with an unencoded header containing the value $(calc.exe) which will execute calc.exe if the request is copied using "Copy as cURL (Windows)" and pasted into PowerShell.

xhttp.open("GET", "//example.com:8000", true);
xhttp.setRequestHeader("test", "$(calc.exe)");
xhttp.send();

Steps to reproduce

1. Use something like python -m SimpleHTTPServer to serve the attached example_POC.html locally.
2. open http://127.0.0.1:8000/example_POC.html in Firefox
3. Open dev tools with F12 and click the Network tab
4. click the "Request data" button
5. Right click the request that is sent and click "Copy as cURL(windows)"
6. Open Powershell, paste the command and hit enter
7. calc.exe will open

I have also attached an HTML page which can be open in Firefox.

Comment 1

[Jan Honza Odvarko [:Honza] (always need-info? me)]

Hubert, could you please look at this one, thanks.

Honza

Comment 2

[Hubert Boma Manilla (:bomsy)]

Attachment: Bug 1615471 - Escape dollar sign for curl on windows r=honza

Escape dollar sign for curl on windows,to fix a security issue
where commands such as $(cmd.exe) can be executed.

Comment 3

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/integration/autoland/rev/2bf07308813d315f192658e38e0f5ba88d7118f0
https://hg.mozilla.org/mozilla-central/rev/2bf07308813d

Comment 4

[Ryan VanderMeulen [:RyanVM]]

Please request Beta and ESR68 approval on this patch when you get a chance.

Comment 5

[Hubert Boma Manilla (:bomsy)]

Comment on attachment 9138461 [details]
Bug 1615471 - Escape dollar sign for curl on windows r=honza

Beta/Release Uplift Approval Request

• User impact if declined: Security bug with curl handling in devtools
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Just fixes a security issue with Command injection in the "Copy as cURL" on Windows
• String changes made/needed: none

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: sec-moderate issue
• User impact if declined: Security bug with curl handling in devtools
• Fix Landed on Version: 77 uplifted to 76
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Just fixes a security issue with Command injection in the "Copy as cURL" on Windows
• String or UUID changes made by this patch: none

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9138461 [details]
Bug 1615471 - Escape dollar sign for curl on windows r=honza

Approved for 76.0b7 and 68.8esr.

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr68/rev/29e0f41feada

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

Changing the priority to p1 as the bug is tracked by a release manager for the current beta.
See What Do You Triage for more information

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/fa4addf36b81

Comment 10

[david.yesland]

Will this be valid for a bounty?

Comment 11

[Ciprian Georgiu, Desktop QA]

I've reproduced this issue with the steps from comment 0, on an affected Nightly build from 2020-02-13.

I can confirm that the cal.exe doesn't open anymore, on any of the fixed builds: latest Nightly 77.0a1, 76.0RC and 68.8.0esr.

Comment 12

[Frederik Braun [:freddy]]

Attachment: advisory.txt