1949994 - (CVE-2025-4084) Copy As Curl(posix) Lead to Code Execution in windows

Status: RESOLVED FIXED

(DevTools :: Netmonitor, defect)

Description

Hi team, Firefox latest version lead to Code Execution on windows machine using copy as curl(posix) feature
The body parameters was not properly sanitized leads to code execution on windows

Steps to reproduce

1. Send the request with malicious code in he body
2. Now from network tab copy the request as curl
3. paste it in cmd and you can find the calc popup

Malcious request

<script>
    fetch("https://example.com/postit", {
        credentials: "omit",
        headers: {
            "Accept-Language": "en-US",
            "Content-Type": "text/plain",
        },
        body: "query=evil\n\n & cmd /c calc.exe \n\n",
        method: "POST",
    });
</script>

Same issue is already fixed in Chromium
Ref:https://issues.chromium.org/issues/352651673

Comment 1

[Ameen Basha M K]

Copy as curl (both windows & bash methods) are sanitized and doesnt trigger calc on windows now, In firefox copy as curl(posix) is vulnerable

Comment 2

[Ameen Basha M K]

Attachment: Firefox-copyascurl.mp4

Poc Video

issue tested on latest version of firefox on windows 11 pro

Comment 3

[Ameen Basha M K]

(In reply to Ameen from comment #1)

Copy as curl (both windows & bash methods) are sanitized and doesnt trigger calc on windows now, In firefox copy as curl(posix) is vulnerable

Kindly ignore this commad they are also vulnerable, but they are not vulnerable on vice versa scenario which ill be raising as a separate ticket for you

Comment 6

[Frederik Braun [:freddy]]

I think all of your bugs stem from the idea that a user would copy for one target system but then use it in another. This is atypical behavior and hard to make happen as an attacker.

At the same time, I will admit that people have accidentally clicked on the wrong button in the past, so it's not impossible.

I think there might be a "tricky" encoding of the request such that we don't cause code execution in whatever target system the command is entered though. https://issues.chromium.org/issues/352651673 is a useful read. Thanks for providing that.

Comment 7

[Ameen Basha M K]

Thanks for the update frederik

Kindly check my comment on #1950001 regarding duplication clarification and kindly reopen the bug

Comment 8

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:Honza, could you have a look please?

For more information, please visit BugBot documentation.

Comment 9

[Jan Honza Odvarko [:Honza] (always need-info? me)]

Bomsy, you were werking on various "Copy As" actions in the Network panel. Could you please take a look, thank you.

Comment 10

[Hubert Boma Manilla (:bomsy)]

Attachment: Bug 1949994 - [devtools] Properly escape the ampersand for Copy as cURL (POSIX) r=#devtools

The Copy as CuRL (POSIX) context menu is enabled for Windows, the historical reason was to allow
Windows users who use other tools (like Cygwin etc) instead of the Win command prompt.

This patch escapes the ampersand which stops a generating a malicous curl command which can be run
on Windows CMD Prompt.

Comment 11

[Hubert Boma Manilla (:bomsy)]

Attachment: Bug 1949994 - [devtools] Properly escape the ampersand for Copy as cURL (POSIX) r=#devtools

The Copy as CuRL (POSIX) context menu is enabled for Windows, the historical reason was to allow
Windows users who use other tools (like Cygwin etc) instead of the Win command prompt.

This patch escapes the ampersand which stops a generating a malicous curl command which can be run
on Windows CMD Prompt.

Comment 12

[Alexandre Poirot [:ochameau]]

chromium fix is along the same line, but they are having a different output and escaping:
https://chromium-review.googlesource.com/c/devtools/devtools-frontend/+/5850610/3/front_end/panels/network/NetworkLogView.ts

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1aeb6e2200c1
[devtools] Properly escape the ampersand for Copy as cURL (POSIX) r=devtools-reviewers,ochameau

Comment 14

[Frederik Braun [:freddy]]

FWIW, I think we could save ourselves a lot of work if we aligned our escaping with Chrome

Comment 15

[Frederik Braun [:freddy]]

In light of this bug, I just stumbled upon this article that might be useful for the Windows-specific copy function, which I admit is not directly related to this. https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way

Comment 16

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/1aeb6e2200c1

Comment 17

[BugBot [:suhaib / :marco]]

The patch landed in nightly and beta is affected.
:bomsy, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox137 to wontfix.

For more information, please visit BugBot documentation.

Comment 18

[Hubert Boma Manilla (:bomsy)]

Comment on attachment 9473892 [details]
Bug 1949994 - [devtools] Properly escape the ampersand for Copy as cURL (POSIX) r=#devtools

Beta/Release Uplift Approval Request

• User impact if declined/Reason for urgency: Potential for running curl commands with malicious code on user machine
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Small js code to escape correctly
• String changes made/needed:
• Is Android affected?: No

Comment 19

[Daniel Veditz [:dveditz]]

dumb bot -- don't ask people to uplift to beta after we've already built the release candidates!

Comment 20

[Dianna Smith [:diannaS]]

Comment on attachment 9473892 [details]
Bug 1949994 - [devtools] Properly escape the ampersand for Copy as cURL (POSIX) r=#devtools

Changing Requests to ESR instead as this will already be in beta as of today with 138

Comment 21

[Ameen Basha M K]

Hi team, any update on bounty?

Comment 22

[Ameen Basha M K]

Hi @daniel the issue was in sec-moderate and it results in code execution on user machine (i understood it requires interaction if not it will fall in high to critical)

My other sec-moderate cases were awarded 4times greater than this bounty which requires interaction too(2023 issues), also this issue have impact more than those other cases.

As stated in comment6 users have clicked this option in windows, so the scenario is already a valid one

I request for reassess of the bounty amount considering the impact on user machine.

Comment 23

[Ameen Basha M K]

Adding a point, i understand other than the severity the realtime vectors will also considered for bounty.

which is already confirmed in comment6, so i believe considering severity and realtime possibilities along with the impact the bounty will be more

Comment 24

[Simon Friedberger [:simonf]]

Yes, we have taken these points into account when determining the bounty. We also factored in, for example, that it needs a technical user with a rare use-case to even access this feature.

Bounties paid in the past should not be used to infer expected amounts. Our guidelines change regularly.

Comment 25

[Ameen Basha M K]

(In reply to Simon Friedberger (:simonf) from comment #24)

We also factored in, for example, that it needs a technical user with a rare use-case to even access this feature.

Yeah but still the firefox user got affected by this vulnerability, Users will trust firefox and pasted the curl command on their command prompts or shell. So i believe the severity is more considering the impact, i request for bounty reassess. Thanks.

Comment 26

[Daniel Veditz [:dveditz]]

My other sec-moderate cases were awarded 4times greater than this bounty

A moderate sunburn is not the same as a moderate earthquake.

The award amount is the amount we have consistently used for Dev Tools "Copy as" bugs.
https://bugzilla.mozilla.org/buglist.cgi?quicksearch=ALL%20prod%3Ddevtools%20sum%3A%22copy%20as%22%20alias%3Acve

Comment 27

[Dianna Smith [:diannaS]]

Comment on attachment 9473892 [details]
Bug 1949994 - [devtools] Properly escape the ampersand for Copy as cURL (POSIX) r=#devtools

Approved for 115.23esr

Comment 28

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/360026777371

Comment 29

[Dianna Smith [:diannaS]]

Comment on attachment 9473892 [details]
Bug 1949994 - [devtools] Properly escape the ampersand for Copy as cURL (POSIX) r=#devtools

Approved for 128.10esr

Comment 30

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/74c3306f6d48

Comment 31

[Jason Kratzer [:jkratzer]]

Attachment: advisory.txt

Comment 32

[Jason Kratzer [:jkratzer]]

Attachment: advisory.txt

Comment 33

[Jason Kratzer [:jkratzer]]

Attachment: advisory.txt