1837675 - (CVE-2023-37208) Diagcab file extension = Executable files may contain viruses or other malicious code

Status: VERIFIED FIXED

(Firefox :: File Handling, defect, P1)

Description

[Umar Farooq [:Puf]]

Attachment: Firefox POC.mp4

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36 Edg/113.0.1774.42

Steps to reproduce:

Create Diagcab file.

Download In Firefox Browser And Open From Firefox Browser

No " Executable files may contain viruses or other malicious code that could harm your computer "

Actual results:

Diagcab File Comes Under harmful files.

Diagcab file extension Should Be blocklisted to prevent users To Open Directly from Firefox Browser

Diagcab file extension Leads to One-Click Exploits in Windows

This File is Already Blocklisted In Chrome & Edge Browsers

Comment 1

[Umar Farooq [:Puf]]

it's better to Add Popop Warning [ Executable files may contain viruses or other malicious code that could harm your computer]
To Diagcab file To Keep Safe System from Exploits

Comment 2

[Daniel Veditz [:dveditz]]

Fixed in chrome-bug 1332392 last fall

Comment 3

[:Gijs (he/him)]

Attachment: Bug 1837675, r?mak,mtigley

Comment 4

[:Gijs (he/him)]

Attachment: Bug 1837675, r?mak,mtigley

Original Revision: https://phabricator.services.mozilla.com/D181082

Comment 5

[Phabricator Automation]

Uplift Approval Request

• Needs manual QE test: yes
• Is Android affected?: no
• Explanation of risk level: just adding an extension to a list
• Code covered by automated testing: yes
• String changes made/needed: No
• Steps to reproduce for manual QE testing: Try downloading a diagcab file. If you can't find one easily, rename one in a local file explorer and drag to the tabstrip. Expected behaviour is that once downloaded there's a prompt when trying to open it, rather than it immediately opening a Windows wizard to install something
• User impact if declined: sec-moderate
• Fix verified in Nightly: no
• Risk associated with taking this patch: Low

Comment 6

[Phabricator Automation]

Uplift Approval Request

• Fix verified in Nightly: no
• Risk associated with taking this patch: Low
• Is Android affected?: yes
• Needs manual QE test: yes
• Code covered by automated testing: yes
• User impact if declined: sec-moderate
• String changes made/needed: No
• Steps to reproduce for manual QE testing: Try downloading a diagcab file. If you can't find one easily, rename one in a local file explorer and drag to the tabstrip. Expected behaviour is that once downloaded there's a prompt when trying to open it, rather than it immediately opening a Windows wizard to install something
• Explanation of risk level: just adding an extension to a list

Comment 7

[:Gijs (he/him)]

Note from uplift request on phab, copying for visibility:

The android bits here are a bit confusing - this code is compiled in on Android so in that sense, yes, it's affected. But on the flip side it's not affected by the sec bug... so what does that make of it? I dunno.

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

r=mak
https://hg.mozilla.org/integration/autoland/rev/b289ac5d9c2a586f78a29e0b54ec2dae1c132aad
https://hg.mozilla.org/mozilla-central/rev/b289ac5d9c2a

Comment 9

[Donal Meehan [:dmeehan]]

https://hg.mozilla.org/releases/mozilla-beta/rev/0e3e70a7494b91f847545f541f60c2afdffdc973

Comment 10

[Umar Farooq [:Puf]]

Hello, For the Bounty, I Have to Email [e-mail]?

Comment 11

[:Gijs (he/him)]

(In reply to Puf from comment #10)

Hello, For the Bounty, I Have to Email [e-mail]?

I think the bounty flag needs setting, which I've just done for you. Pinging :tjr to check if there's anything else to do.

Comment 12

[Umar Farooq [:Puf]]

Thank You :)

Comment 13

[Tom Ritter [:tjr]]

Nope, thanks!

Comment 14

[Donal Meehan [:dmeehan]]

:mak, since :gijs is on PTO, could you take a look at adding an esr uplift request on this and a patch based on esr?

Comment 15

[Marco Bonardo [:mak]]

Attachment: Bug 1837675.

Original Revision: https://phabricator.services.mozilla.com/D181082

Comment 16

[Marco Bonardo [:mak]]

Comment on attachment 9340449 [details]
Bug 1837675.

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: sec-moderate security issue, patched in other browsers
• User impact if declined: diagcab files don't show the executable warning
• Fix Landed on Version: 116
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): just adding an extension to a list

Comment 17

[Marco Bonardo [:mak]]

Sorry I tried to insert the request on phabricator but it keeps giving errors.

Comment 18

[Donal Meehan [:dmeehan]]

Comment on attachment 9340449 [details]
Bug 1837675.

Moving request to esr102

Comment 19

[Bogdan Maris, Desktop Test Engineering]

Reproduced the initial issue using and old Nightly from 2023-06-16, the windows wizard is opened immediately after trying to open the .diagcab files.
Verified that using latest Nightly 2023-06-25 and latest Firefox 115.0b9 Beta version there is a prompt now when trying to open the .diagcab files on both Windows 10 64bit and Windows 11.

Prompt:
"<name>.diagcab is an executable file. Executable files may contain viruses or other malicious code that could harm your computer. Use caution when opening this file. Are you sure you want to launch "<name>.diagcab"?
Removing the qe-verify+ for now, will verify this as well on ESR once/if the fix reaches this branch.

Comment 20

[Marco Bonardo [:mak]]

Attachment: Bug 1837675, r=dmeehan

Comment 21

[Marco Bonardo [:mak]]

Comment on attachment 9341131 [details]
Bug 1837675, r=dmeehan

ESR Uplift Approval Request

See comment 16

Comment 22

[Marco Bonardo [:mak]]

Attachment: Bug 1837675, r=dmeehan

Comment 23

[Marco Bonardo [:mak]]

Attachment: Bug 1837675, r=dmeehan

Original Revision: https://phabricator.services.mozilla.com/D182113

Comment 24

[Marco Bonardo [:mak]]

Comment on attachment 9341137 [details]
Bug 1837675, r=dmeehan

ESR Uplift Approval Request

see comment 16

This one is on ESR branch. Sorry for the confusion, moz-phab was not doing what I was expecting.

Comment 25

[Donal Meehan [:dmeehan]]

Comment on attachment 9341137 [details]
Bug 1837675, r=dmeehan

Approved for 102.13esr.

Comment 26

[Donal Meehan [:dmeehan]]

https://hg.mozilla.org/releases/mozilla-esr102/rev/169f7b3be57e

Comment 27

[Umar Farooq [:Puf]]

Please Any Status on Bounty?

Comment 28

[Jason Kratzer [:jkratzer]]

Attachment: advisory.txt

Comment 29

[Bogdan Maris, Desktop Test Engineering]

(In reply to Bogdan Maris, Desktop QA from comment #19)

Reproduced the initial issue using and old Nightly from 2023-06-16, the windows wizard is opened immediately after trying to open the .diagcab files.
Verified that using latest Nightly 2023-06-25 and latest Firefox 115.0b9 Beta version there is a prompt now when trying to open the .diagcab files on both Windows 10 64bit and Windows 11.

Prompt:
"<name>.diagcab is an executable file. Executable files may contain viruses or other malicious code that could harm your computer. Use caution when opening this file. Are you sure you want to launch "<name>.diagcab"?
Removing the qe-verify+ for now, will verify this as well on ESR once/if the fix reaches this branch.

Also verified that this is fixed on 102.13esr-build2 on the same configurations as above.