1928674 - CWE-223: Omission of Security-relevant Information - Firefox immediate download

Status: RESOLVED DUPLICATE of bug 1756304

(Firefox :: Security, defect)

Description

[Michal Biesiada]

Hi, at this moment the newest version of Firefox on Desktop (Windows) is vulnerable to CWE-223: Omission of Security-relevant Information - immediate download action.

Tech details: desktop ver 132.0 (64-bit) - the newest 2024-11-01.

POC and Repro steps:
Use payloads below - open these links using Firefox browser - see downloaded files without asking user if want to save it.

Payload examples: https://wac-cdn.atlassian.com/dam/jcr:f98fe034-58d1-4ceb-9658-f68e617097db/header-image.png?cdnVersion=1373
https://jdi.epam.com/content/dam/epam/ru/Join-us-spb/13_icons_330x330px.png
https://www.lg.com/content/dam/lge/common/common-icon/icon_manual-software_48.svg

Please notice that it can be done using tiny user interaction (click or visit prepared site/endpoint).
The action can be not noticed, but after some time user can open malicious file from curiosity or by accident (named 'invoices' etc).

Bad actors can exploit this to infect the victim's device (link can be prepared as to trigger download file action - and it works with Firefox browser at this moment). Moreover, it can be noticed in CTRL+J (downloads) - e.g. inappropriate content on work equipment (downloaded without the user intending to download it).

Please notice that in the same time, the newest version of Firefox on Android has implemented proper approach - prompt/question about download action.

Proposed proper solution - prompt to confirm download action.

References:
https://cwe.mitre.org/data/definitions/223.html
https://cwe.mitre.org/data/definitions/356.html

Best regards,

Comment 1

[Daniel Veditz [:dveditz]]

I personally dislike it, but this is an intentional choice. Most of the time for most (legit) downloads users hate the extra friction of the prompt, and we changed our behavior to match other browsers. More recently Safari added a one-time per-site download permission prompt which we'll keep an eye on. In Settings you can switch the default behavior back to "Always ask"

see https://support.mozilla.org/en-US/kb/manage-downloads-preferences-using-downloads-menu