1817768 - (CVE-2023-28163) Vulnerability in Firefox 'Save As' Dialog Allows Attackers to Steal Environment Variables

Status: VERIFIED FIXED

(Firefox :: File Handling, defect)

Description

[Shaheen Fazim]

Attachment: poc.html

Normally, when a file is saved using the "Save As" dialog in the Firefox browser, the user is protected from different types of attacks by filtering out dangerous extensions or characters.

However, there is a remaining vulnerability where an attacker can place environment variables at the end of the file extension, which allows % signs to pass through without being filtered. An attacker can exploit this vulnerability to steal a victim's stored environment variable, such as various secret keys ( AWS, AZURE, Firebase, etc.), or other tokens.

Steps to Reproduce:

This vulnerability works when a user has set the "Save As" dialog as the default download option (Settings → Files and Applications → Downloads → “Always ask you where to save files” is checked). Alternatively, an attacker could lure the victim into using the right-click download method, which always opens the "Save As" dialog for downloading a file.

1. Download and open the poc.html file in Firefox.
2. Download the file using one of the methods mentioned above on the poc.html page.
3. Upload the downloaded file to the poc.html page and observe that the secret is extracted (in this case, the username environment variable is used).

this vulnerability is similar to https://bugzilla.mozilla.org/show_bug.cgi?id=1765049 and https://bugs.chromium.org/p/chromium/issues/detail?id=1247389

Comment 1

[:Gijs (he/him)]

Molly, are you able to take a look at this given the similarities to bug 1765049?

Comment 2

[Molly Howell (she/her) (mostly inactive)]

Sure.

Comment 3

[Molly Howell (she/her) (mostly inactive)]

Attachment: Bug 1817768 - Filter out illegal file extensions. r=gijs

Comment 4

[Molly Howell (she/her) (mostly inactive)]

Comment on attachment 9319066 [details]
Bug 1817768 - Filter out illegal file extensions. r=gijs

Security Approval Request

• How easily could an exploit be constructed based on the patch?: There unfortunately isn't anything really going on in this patch that wasn't already in bug 1817768, so if it's going to be easy, then it already was easy.
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: Unknown
• Which older supported branches are affected by this flaw?: all
• If not all supported branches, which bug introduced the flaw?: None
• Do you have backports for the affected branches?: No
• If not, how different, hard to create, and risky will they be?: Should be trivial on all counts.
• How likely is this patch to cause regressions; how much testing does it need?: This is exactly the same fix as bug 1817768, applied to the file extension string instead of just the name, so risk should be very very low.
• Is Android affected?: No

Comment 5

[Andrew McCreight [:mccr8]]

I assume the bugs references in the sec approval request were intended to be bug 1765049.

Comment 6

[Molly Howell (she/her) (mostly inactive)]

That's correct, I apologize.

Comment 7

[Tom Ritter [:tjr]]

Comment on attachment 9319066 [details]
Bug 1817768 - Filter out illegal file extensions. r=gijs

Approved to request uplift and land.

Comment 8

[Molly Howell (she/her) (mostly inactive)]

Comment on attachment 9319066 [details]
Bug 1817768 - Filter out illegal file extensions. r=gijs

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration:
• User impact if declined: Remote information disclosure vulnerability.
• Fix Landed on Version: 112
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Please see sec-approval request in comment 4.

Beta/Release Uplift Approval Request

• User impact if declined:
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky):
• String changes made/needed:
• Is Android affected?: No

Comment 9

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Filter out illegal file extensions. r=Gijs
https://hg.mozilla.org/integration/autoland/rev/92e31c77313890eaa09939ab5a367cb1e4f3067b
https://hg.mozilla.org/mozilla-central/rev/92e31c773138

Comment 10

[Shaheen Fazim]

Thank you for addressing the reported issue in a timely manner. As the bug seems to have been fixed quickly, can I request approval for a security bounty? Thank you.

Comment 11

[Andrew McCreight [:mccr8]]

The sec-bounty? flag has been set, and the bug has now been closed, so it will be reviewed at the weekly bug bounty meeting.

Comment 12

[Donal Meehan [:dmeehan - PTO - Back Oct 13]]

Comment on attachment 9319066 [details]
Bug 1817768 - Filter out illegal file extensions. r=gijs

Approved for 111.0b7

Comment 13

[Donal Meehan [:dmeehan - PTO - Back Oct 13]]

https://hg.mozilla.org/releases/mozilla-beta/rev/0f825cab4a25

Comment 14

[Daniel Veditz [:dveditz]]

The rating keywords copied over from the older bug don't match this one. Although the mechanism is similar, the capability is not. The requirement to have to re-upload the file you just downloaded makes this a very unlikely attack to succeed and requires a moderate rating. The value of most standard environment variables are explicitly listed as "moderate" in our criteria. Grabbing a special key value as mentioned in comment 0 would certainly be much more severe and you could plausibly target developers who might have such variables, but you still have the "convince to re-upload" hurdle.

This is a good find, just wrongly rated.

Comment 15

[Donal Meehan [:dmeehan - PTO - Back Oct 13]]

Comment on attachment 9319066 [details]
Bug 1817768 - Filter out illegal file extensions. r=gijs

Approved for 102.9esr.

Comment 16

[Donal Meehan [:dmeehan - PTO - Back Oct 13]]

https://hg.mozilla.org/releases/mozilla-esr102/rev/5f3e4843f1f1

Comment 17

[Frederik Braun [:freddy]]

Attachment: advisory.txt