1921458 - (CVE-2024-11693) Microsoft .library-ms files potentially unsafe

Status: VERIFIED FIXED

(Firefox :: File Handling, defect, P2)

Description

[Marco Bonardo [:mak]]

Chromium has added full ping for .library-ms, the code comment reads as:

  # Windows Library Description Schema. This is a shell extension that can
  # cause information to be leaked to remote file shares.
  # https://learn.microsoft.com/en-us/windows/win32/shell/library-schema-entry

The MS documentation doesn't say much, I found a little bit additional information here
https://wikileaks.org/ciav7p1/cms/page_13763381.html
https://medium.com/@mhwee/unmasking-windows-library-files-a-deep-dive-into-client-side-exploitation-6bf3371a5262

I'm not sure whether we should just add these to the safebrowsing list, or also executable lists.
Doesn't look like a format that has a lot of value when downloaded from the Web, so making it a bit more annoying to execute may not be a big deal.

Comment 1

[Marco Bonardo [:mak]]

let's add this as executable, considered it's not very commonly downloaded anyway, so adding a warning won't break common workflows.

Comment 2

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:Gijs, could you have a look please?

For more information, please visit BugBot documentation.

Comment 3

[Marco Bonardo [:mak]]

Attachment: Bug 1921458. r=dimi

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a204c2271733
r=dimi

Comment 5

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/a204c2271733

Comment 6

[Marco Bonardo [:mak]]

Attachment: Bug 1921458. r=dimi

Original Revision: https://phabricator.services.mozilla.com/D226775

Comment 7

[Phabricator Automation]

beta Uplift Approval Request

• User impact if declined: sec-moderate
• Code covered by automated testing: yes
• Fix verified in Nightly: no
• Needs manual QE test: yes
• Steps to reproduce for manual QE testing: Try downloading a file with one of these extensions. If you can't find one easily, rename one in a local file explorer and drag to the tabstrip. Expected behaviour is that once downloaded there's a prompt when trying to open it, rather than it immediately execute
• Risk associated with taking this patch: low
• Explanation of risk level: Adding file extension to a list
• String changes made/needed: none
• Is Android affected?: no

Comment 8

[Marco Bonardo [:mak]]

Attachment: Bug 1921458. r=dimi

Original Revision: https://phabricator.services.mozilla.com/D226775

Comment 9

[Phabricator Automation]

esr128 Uplift Approval Request

• User impact if declined: sec-moderate
• Code covered by automated testing: yes
• Fix verified in Nightly: no
• Needs manual QE test: yes
• Steps to reproduce for manual QE testing: Try downloading a file with one of these extensions. If you can't find one easily, rename one in a local file explorer and drag to the tabstrip. Expected behaviour is that once downloaded there's a prompt when trying to open it, rather than it immediately execute
• Risk associated with taking this patch: Low
• Explanation of risk level: Adding file extension to a list
• String changes made/needed: none
• Is Android affected?: no

Comment 10

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/0e781af3c946

Comment 11

[Peter Magyari (Desktop QA)]

Hi,

I am trying to verify the fix but unfortunately I couldn't find a .library-ms file to download and when I created a new one and renamed it in a local file explorer and then dragged it to the tab-strip it opened the file inside without any prompt (on the fixed versions) could you please attach a file with that extension that I could use?

Thank you!

Comment 12

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/e983e8a66e51

Comment 13

[Marco Bonardo [:mak]]

(In reply to Peter Magyari (Desktop QA) from comment #11)

could you please attach a file with that extension that I could use?

I think you can test using this link https://mime.ty.ax/dl/test.library-ms?ty=txt&ct=application%2Foctet-stream&cd=attachment

Comment 14

[Peter Magyari (Desktop QA)]

I have verified the fix on Nightly 134.0a1 (20241104213308), Beta 133.0b4 (20241104091514) and 128.5.0esr (20241102140110).
Thank you for the link Marco!

Comment 15

[Tom Ritter [:tjr]]

Attachment: advisory.txt