1828716 - (CVE-2023-32214) “ms-cxh” and “ms-cxh-full” protocol handlers considered harmful

Status: RESOLVED FIXED

(Firefox :: File Handling, defect)

Description

[:Gijs (he/him)]

These protocol handlers exist on Win10 and they can do things like soft-locking the machine. They probably shouldn't be accessible through the browser by default.

Comment 1

[:Gijs (he/him)]

Attachment: Bug 1828716, r?sclements

Comment 2

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

r=sclements
https://hg.mozilla.org/integration/autoland/rev/39efb7cf2eb42fb6f8f7e9b601c7ffcc262e81aa
https://hg.mozilla.org/mozilla-central/rev/39efb7cf2eb4

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:Gijs, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox113 to wontfix.

For more information, please visit auto_nag documentation.

Comment 4

[:Gijs (he/him)]

Attachment: Bug 1828716, r?sclements

Original Revision: https://phabricator.services.mozilla.com/D175789

Comment 5

[Phabricator Automation]

Uplift Approval Request

• Is Android affected?: no
• String changes made/needed: No
• Needs manual QE test: no
• User impact if declined: potential security hole
• Risk associated with taking this patch: Low
• Explanation of risk level: Just adding prefs to block certain protocols in ways we've done numerous times before
• Code covered by automated testing: no
• Fix verified in Nightly: no
• Steps to reproduce for manual QE testing: N/A

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9329495 [details]
Bug 1828716, r?sclements

Approved for 113.0b6.
https://hg.mozilla.org/releases/mozilla-beta/rev/e199af712ade1166697d7273a174407ae50d38b7

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9329096 [details]
Bug 1828716, r?sclements

Approved for 102.11esr.

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr102/rev/74afadea7afd

Comment 9

[Tyson Smith [:tsmith]]

Attachment: advisory.txt

Comment 10

[Tyson Smith [:tsmith]]

Attachment: advisory.txt