1737252 - (CVE-2022-22744) Escape issue in "Copy as cURL" enables execution of arbitrary commands on users computer

Status: VERIFIED FIXED

(DevTools :: Netmonitor, defect, P2)

Description

[Mattias Jacobsson]

Attachment: POC.html

Description

The constructed curl command from the "Copy as cURL" feature in devtools isn't properly escaped for the platform WINNT. This means that a malicious website can make network requests that, if the user copies and tries to run them in PowerShell, will enable the website to run arbitrary commands on the users computer.

Steps to reproduce

This proof of concept includes three variants, each one work independently, and there should be many more combinations that should produce information leakage and arbitrary code execution.

1. Start the browser and open devtools. Then visit the attached file POC.html.
2. Select the "Network" tab in devtools and right click on the POST request and click "Copy as cURL (Windows)" under "Copy".
3. Paste the command in PowerShell and execute it.
4. Now three things should happen; the remote server should have your environment variable PATH, the shell should (among other things) show "Hello World", and the "calc.exe" application should open.

How and why does it work?

The attack shown above work because it is possible to use the escape character ` to escape itself and other vital characters. Hence circumventing the escaping preformed by Firefox.

The code responsible for this in Firefox is located in the function at: https://searchfox.org/mozilla-central/source/devtools/client/shared/curl.js#429

See also

Bug 1518026, Bug 1607742, and Bug 1614468 are old bugs with similar issues.

Please let me know if I can be of any help!

Comment 1

[Mattias Jacobsson]

Example

To illustrate what could happen, I thought that I should show the details of Ex. 3 from POC.html. That is, if we remove the headers from the fetch call and thereby Ex. 1 & 2, the generated curl command will be something like;

curl [...] --data-raw "``$(calc.exe)"
                       #^###########

Where the data marked by ^ is added by Firefox and the data marked by # comes from the body tag in fetch. What happens is that Firefox adds a ` to escape the $. However this escape will inadvertently get escaped by the already present `, rendering the $ unescaped. The responsible code is located at 1.

Reasoning around potential solutions

For PowerShell one would probably want to switch to single-quotation marks(2) and potentially use the --% sequence(3). However these, as I understand it, doesn't really work in cmd.exe. Hence to keep the generated curl commands somewhat compatible with both PowerShell and cmd.exe one would probably want to try to escape the ` properly. (Escaping ` in PowerShell is probably wise regardless of the issue at hand, see 3.)

PowerShell and cmd.exe is undeniably quite different. So adding an escape sequence for PowerShell may produce a curl command which when used in cmd.exe executes a request that isn't equivalent to the actual network request being copied. This is another issue however; but this seams to already be happening with for example the $-sign.

My understanding is that Firefox shares (shared?) some code in this area with Chromium. Their solution to this problem seams to be that they created two alternatives; one for PowerShell(not using curl) and one for cmd.exe. These different alternatives seams to be created in a way that purposely makes them not work in the opposite shell. While this solution has its own problems, it might be the best available.

This is just a few ideas I had. However, I will leave it up to you to decide how you want to go about solving this issue.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:Honza, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 3

[Jan Honza Odvarko [:Honza] (always need-info? me)]

Hubert, could you please look at this, thank you!

Comment 4

[Hubert Boma Manilla (:bomsy)]

Thanks Honza!

i'll look into it.

Comment 5

[Hubert Boma Manilla (:bomsy)]

Attachment: Bug 1737252 - [devtools] Escaping back tick signs r=nchevobbe

Depends on D129946

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

[devtools] Escaping back tick signs r=nchevobbe
https://hg.mozilla.org/integration/autoland/rev/d1a6d4666ba9cf8d834ef1d6390283e5b50476d8
https://hg.mozilla.org/mozilla-central/rev/d1a6d4666ba9

Comment 7

[Daniel Veditz [:dveditz]]

We probably should fix this on ESR as well. Simple enough patch (low regression risk) and also a simple enough social engineering attack once published.

Comment 8

[Ryan VanderMeulen [:RyanVM][PTO June 24-28]]

Please nominate this for ESR approval when you get a chance. It grafts cleanly.

Comment 9

[Hubert Boma Manilla (:bomsy)]

Comment on attachment 9250468 [details]
Bug 1737252 - [devtools] Escaping back tick signs r=nchevobbe

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: Proves a security risk as curl can be hijacked to execute commands in windows
• User impact if declined: Possible security risk
• Fix Landed on Version:
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Small javascript patch to escape back ticks
• String or UUID changes made by this patch:

Comment 10

[Ciprian Georgiu, Desktop QA]

Reproduced this bug using POC.html, from comment 0, on Win 10 x64 with an affected Nightly build (95.0a1, 20211022213234).

The issue is not reproducing anymore on Beta 96.0b4 (20211212185725) running Win 10 x64.

Comment 11

[Ryan VanderMeulen [:RyanVM][PTO June 24-28]]

Comment on attachment 9250468 [details]
Bug 1737252 - [devtools] Escaping back tick signs r=nchevobbe

Approved for 91.5esr.

Comment 12

[Ryan VanderMeulen [:RyanVM][PTO June 24-28]]

https://hg.mozilla.org/releases/mozilla-esr91/rev/b5857a3da213

Comment 13

[Ciprian Georgiu, Desktop QA]

This is also verified as fixed on 91.5 esr, under Win 11.

Comment 14

[Frederik Braun [:freddy]]

Attachment: advisory.txt