1793551 - (CVE-2022-45415) Create arbitrary binary(.hta,.exe,.bat,.vb)/file when web page is downloaded/saved in firefox browser

Status: VERIFIED FIXED

(Firefox :: Downloads Panel, defect, P2)

Description

[Jayateertha Guruprasad]

Attachment: index.html

Products affected:

Latest Firefox for Windows as on 04/10/22

POC:

See this Video POC - https://youtu.be/5PBJ1MlikFk

1. Host malicious webpage (index.html) [See attached file].
2. Click save as to download the website to view offline or press (ctrl + s).
3. Save the file & open downloaded file

Impact

1. Create arbitrary files instead of html file, which might result in code execution when opened.

Fix

1. Sanitize filename properly & append .html to filename created from title tag by default as done by major browsers such as Google Chrome.

Comment 1

[Jayateertha Guruprasad]

Hi team,

Hope this is eligible for bounty.
Incase eligible kindly nominate this for bounty, I am not sure of the bounty nomination process followed by firefox.

Comment 2

[Andrew McCreight [:mccr8]]

(In reply to Jayateertha Guruprasad from comment #1)

Incase eligible kindly nominate this for bounty, I am not sure of the bounty nomination process followed by firefox.

Setting the sec-bounty? flag like you did is sufficient for it to be considered.

Comment 3

[:Gijs (he/him)]

This is basically a dupe of bug 1778597, but with security impact. :-(

Comment 4

[Jayateertha Guruprasad]

Hi team,

I don't think this is the exact same bug, I have not seen that before and have reported by my own research.

After going through bug (1778597)[https://bugzilla.mozilla.org/show_bug.cgi?id=1778597] , I assume that bug is about ending the extensions with TLD (.com, .in etc), and no where talks about the security impact or the exploit I mentioned in my report, although the fix might be same. (Appending .html/.htm at the end).

CVE's can be assigned only for reports with security impact or affecting security triads (Confidentiality, Integrity, Availability).

So, I would like to know if my report is eligible for a CVE rather than (1778597)[https://bugzilla.mozilla.org/show_bug.cgi?id=1778597] which also seems to be internally reported if I am not wrong.

Thanks and Regards
Jayateertha G

Comment 5

[Jayateertha Guruprasad]

Also just a suggestion, Kindly make (https://bugzilla.mozilla.org/show_bug.cgi?id=1778597)[bug 1778597] as private so that, as that report might give an idea of exploit to other researchers.

Comment 6

[Jayateertha Guruprasad]

Hi team,

Any updates on this issue ?

Please feel free to contact me if you need any assistance reproducing the issue or anything else required from my side.

Thanks and Regards
Jayateertha G

Comment 7

[:Gijs (he/him)]

(In reply to Jayateertha Guruprasad from comment #4)

I don't think this is the exact same bug,

It's the window/document title ending in .foo resulting in a .foo file extension when saving the page. I don't see any difference.

no where talks about the security impact or the exploit I mentioned in my report,

If you were wanting to drop a file on the user's machine you could just start a download when clicking on the page, which is probably an easier thing to convince the user to do than to use "save page as" and then open the result, and also allows controlling the full contents of the result.

CVE's can be assigned only for reports with security impact or affecting security triads (Confidentiality, Integrity, Availability).
So, I would like to know if my report is eligible for a CVE rather than (1778597)[https://bugzilla.mozilla.org/show_bug.cgi?id=1778597]

--> Tom ?

which also seems to be internally reported

Not really, jscher is a volunteer contributor, not an employee.

(In reply to Jayateertha Guruprasad from comment #6)

Any updates on this issue ?

Please do not comment just to ask for updates. Any updates will be on the bug and unless you changed your bugzilla settings you'll get email for them. If there are no updates on the bug then there are no updates.

Comment 8

[Jayateertha Guruprasad]

Thanks for the info, as I have not reported much in bugzilla, there were many flags which were confusing.

I didn't know, if I set the flags right or would recieve update.

Thanks and Regards
Jayateertha G

Comment 9

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Presently the report is a sec-moderate, so yes, when it is fixed it will receive a CVE. If it is a duplicate, we typically include all of the reporters who have meaningfully contributed new information to the report, so in this case although Bug 1778597 was filed first, you were the first (AFAICT) to detail the security impact of it, so you would both be credited. A decision about rewarding a bounty is similar.

Comment 10

[Jayateertha Guruprasad]

Team,

Thanks very much for your valuable reply.
Will wait for the bug to be fixed.

Thanks and Regards
Jayateertha G

Comment 11

[Neil Deakin]

I believe this should have been fixed now by bug 1778597.

Comment 12

[Jayateertha Guruprasad]

Hi team ,

I would like to retest the reported vulnerability, kindly share the retest build url.

Also as the reported vulnerability is said to be fixed, may I know about the CVE and bounty process.

Thanks very much for the quick fix and response.

Thanks and Regards
Jayateertha G

Comment 13

[Jayateertha Guruprasad]

Hi team ,

Any updates on my previous comment ?

Thanks and Regards
Jayateertha G

Comment 14

[Marco Bonardo [:mak]]

Updates will be posted to the bug when available

Comment 15

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Sorry, I don't think Marco noticed Neil's comment. You can test this on Firefox Nightly - https://www.mozilla.org/en-US/firefox/channel/desktop/#nightly The next time we meet to process bug bounties, this will be in the queue, it will typically take 1-2 weeks for a decision, as we meet weekly.

Comment 16

[Jayateertha Guruprasad]

Thanks very much @Tom ,
will retest and let you know soon.

Also will wait for the CVE/Bounty decision.

Thanks and Regards
Jayateertha G

Comment 17

[Jayateertha Guruprasad]

Hi team,

Sorry for late update, was in vacation last week.

I have retested in the latest nightly build for windows,
The issue seems to have been fixed! 🎊

Kindly let me know when the bounty process is initiated/CVE published.

Thanks and Regards
Jayateertha G

Comment 18

[Virgil Sangerean]

Reproduced issue on 107.0b8 Firefox.
Issue is verified-fixed in 108.0a1 Nightly build: 2022-11-01-21-36-59-mozilla-central.

Comment 19

[Virgil Sangerean]

Verified fixed in Firefox 107.0b9.

Comment 20

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Attachment: advisory.txt