1823077 - (CVE-2023-29545) Save file containing environment variables in "Save Link As" on Firefox 111 Windows

Status: VERIFIED FIXED

(Firefox :: Security, defect)

Description

[haxatron1]

Attachment: test.html

Not sure if you noticed but its still possible to save files containing %% when using "Save Link As" on Firefox 111.0 -- https://www.mozilla.org/en-US/security/advisories/mfsa2023-09/#CVE-2023-28163

STR

1. Right click Save Link As on this document.

Comment 1

[haxatron1]

Right click Save Link As on the URL in this document.

Comment 2

[haxatron1]

o

Comment 3

[:Gijs (out for now; he/him)]

Attachment: Bug 1823077, r?mhowell

Comment 4

[:Gijs (out for now; he/him)]

CVE-2023-28163 was sec-moderate, so I don't see this being more - arguably it's sec-low because it requires more user action than "just" downloading something (which can be site-triggered, whereas the STR here require the context menu), though the older bug required configuration, so 🤷‍♂️. I've picked sec-moderate for now, but given that I don't see this being sec-high, going to assume I'm OK to land and uplift this...

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/88f9b48c9615

Comment 6

[:Gijs (out for now; he/him)]

Comment on attachment 9323977 [details]
Bug 1823077, r?mhowell

Beta/Release Uplift Approval Request

• User impact if declined: sec-moderate
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: See comment 0
• List of other uplifts needed: n/a
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Very small patch in targeted bit of the windows filepicker code
• String changes made/needed: Nope
• Is Android affected?: No

Comment 7

[:Gijs (out for now; he/him)]

Comment on attachment 9323977 [details]
Bug 1823077, r?mhowell

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: sec-moderate
• User impact if declined: ditto
• Fix Landed on Version: 113 w/ beta uplift 112 requested
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Very small patch in targeted bit of the windows filepicker code

Comment 8

[Daniel Veditz [:dveditz]]

yes, moderate sounds right.

Comment 9

[Dianna Smith [:diannaS]]

Comment on attachment 9323977 [details]
Bug 1823077, r?mhowell

Approved for 112.0b6

Comment 10

[Dianna Smith [:diannaS]]

https://hg.mozilla.org/releases/mozilla-beta/rev/2c1b5418151d

Comment 11

[Ciprian Georgiu, Desktop QA]

I have reproduced the bug on Win 11 with an affected Nightly build 113.0a1 (2023-03-17).

The issue is verified as fixed on latest Nightly 113.0a1 and Beta 112.0b6 under Win 11 x64. I'll verify the bug in Esr as well, if the patch is approved.

Comment 12

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9323977 [details]
Bug 1823077, r?mhowell

Approved for 102.10esr.

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr102/rev/6f4b98115f51

Comment 14

[Ciprian Georgiu, Desktop QA]

This is also verified as fixed on 102.10.0esr with Win 11 x64.

Comment 15

[Tom Ritter [:tjr]]

Attachment: advisory.txt