1950001 - Copy As Curl(Windows) Lead to Code Execution in Linux

Status: RESOLVED FIXED

(DevTools :: Netmonitor, defect, P2)

Description

Attachment: firefox-copyascurl(windows).mp4

Hi team, Firefox latest version lead to Code Execution on linux machine using copy as curl(windows) feature
The body parameters was not properly sanitized leads to code execution on linux environment

Steps to reproduce

1. Send the request with malicious code in the body
2. Now from network tab copy the request as curl (windows)
3. paste it in bash shell and you can find the whoami command executed

Malcious request

 fetch("https://example.com/postit", {
        credentials: "omit",
        headers: {
            "Accept-Language": "en-US",
            "Content-Type": "text/plain",
        },
        body: "query=evil\n\nwhoami",
        method: "POST",
    });

My another vice versa issue reference: https://bugzilla.mozilla.org/show_bug.cgi?id=1949994

Note: Chrome is not vulnerable for this, I have showed this in poc video too.

This should be prevented similar to chrome to avoid accidental code execution on linux while working with multiple environment

Comment 3

[Ameen Basha M K]

@frederik seems there is some misunderstanding in marking the bugs as duplicate.

1949994 - Copy as curl (posix) feature
1950001(this ticket) - Copy as curl (windows) feature

Both these options are having separate code base and separate options in firefox browser, it will not be fall under duplication.

Kindly reopen this bug.

Comment 4

[Frederik Braun [:freddy] (OOO - Back April 8th)]

I agree that this might require more than one fix. However, I think we would all benefit if there was a single discussion in this one bug instead of 3 fragmented discussions.

Comment 5

[Ameen Basha M K]

(In reply to Frederik Braun [:freddy] from comment #4)

I agree that this might require more than one fix. However, I think we would all benefit if there was a single discussion in this one bug instead of 3 fragmented discussions.

It will be fine for a fix discussion, but feature wise it was a 2 different area and here it affects my bounty too if it was handled in single ticket though the fix needs to be in multiple place.

So kindly track this as separate one for bounty

Comment 6

[Daniel Veditz [:dveditz]]

I suspect this is actually in the same code and won't require a separate fix, but we can make this "depends on" for now.

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:Honza, could you have a look please?

For more information, please visit BugBot documentation.

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:Honza, could you have a look please?

For more information, please visit BugBot documentation.

Comment 9

[Hubert Boma Manilla (:bomsy)]

I'll take a look at this.

Comment 10

[Jan Honza Odvarko [:Honza] (always need-info? me)]

Bomsy, please set priority and severity for this bug, thank you.

Comment 11

[Ameen Basha M K]

(In reply to Daniel Veditz [:dveditz] from comment #6)

I suspect this is actually in the same code and won't require a separate fix, but we can make this "depends on" for now.

HI Team, the issue 1949994 is fixed and closed now and i have tested the same in firefox nightly and it is not reproduced. Escaped with ^

As stated by myself before, fix of 1949994 will not fix this issue, since these 2 are handled in different methods it requires fixes in 2 different places.

Kindly initiate a separate fix for this issue. Also since it remains unfixed even after the 1949994 closed it will be considered as an separate issue as stated in comment 3

Note: As stated in description chrome is not vulnerable for this case (It was showed in the first poc video attached)

Comment 12

[Ameen Basha M K]

Attachment: 1950001-SeparateFix-Needed.mp4

I have attached a video poc to show 1949994 is fixed in nightly but 1950001 is still vulnerable

Comment 13

[Hubert Boma Manilla (:bomsy)]

Attachment: Bug 1950001 - [devtools] Fix Copy As cURL(Windows) on linux r=#devtools

Comment 14

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/5e3231d83f0d
[devtools] Fix Copy As cURL(Windows) on linux r=devtools-reviewers,nchevobbe

Comment 15

[Pulsebot]

Backout by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/56155463023a
Backed out changeset 5e3231d83f0d for causing xpcshell failures on test_curl.js.

Comment 16

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Backed out for causing xpcshell failures on test_curl.js.
Push with failures: https://treeherder.mozilla.org/jobs?repo=autoland&group_state=expanded&selectedTaskRun=B[…]pcshell&revision=5e3231d83f0df129847e9ec56658d5b82cfbc37b
Failure log: https://treeherder.mozilla.org/logviewer?job_id=501986848&repo=autoland&lineNumber=4342
Backout link: https://hg.mozilla.org/integration/autoland/rev/56155463023a4bb562d4446d675573c2b908f8c1

[task 2025-04-02T07:08:06.963Z] 07:08:06     INFO -  TEST-PASS | devtools/client/shared/test/xpcshell/test_curl.js |  - host header ignored - to be generated from url - true == true
[task 2025-04-02T07:08:06.963Z] 07:08:06  WARNING -  TEST-UNEXPECTED-FAIL | devtools/client/shared/test/xpcshell/test_curl.js |  - accept header present in curl command - false == true
[task 2025-04-02T07:08:06.963Z] 07:08:06     INFO -  D:/task_174357691395686/build/tests/xpcshell/tests/devtools/client/shared/test/xpcshell/test_curl.js:null:45

Comment 17

[Ameen Basha M K]

Friendly Reminder, The changes are approved 12 days back, but seems due to test case failure it was pending, can you guys update on this?

Comment 18

[Hubert Boma Manilla (:bomsy)]

Thanks Ameen. I’m on it. tnxs

Comment 19

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/991c7b596351
[devtools] Fix Copy As cURL(Windows) on linux r=devtools-reviewers,nchevobbe

Comment 20

[Pulsebot]

Backout by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/81048cca6fa5
Backed out changeset 991c7b596351 for causing xpcshell failures @ test_curl.js CLOSED TREE

Comment 21

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7238f9bd1c5c
[devtools] Fix Copy As cURL(Windows) on linux r=devtools-reviewers,nchevobbe

Comment 22

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Backed out for causing xpcshell failures of test_curl.js:
https://hg.mozilla.org/integration/autoland/rev/d1cfe436879aa5f39e94e0781d10f2f792d30d9a

Push with failures
Failure log

[task 2025-04-15T11:37:57.519Z] 11:37:57     INFO -  TEST-PASS | devtools/client/shared/test/xpcshell/test_curl.js |  - host header ignored - to be generated from url - true == true
[task 2025-04-15T11:37:57.519Z] 11:37:57  WARNING -  TEST-UNEXPECTED-FAIL | devtools/client/shared/test/xpcshell/test_curl.js |  - accept header present in curl command - false == true
[task 2025-04-15T11:37:57.519Z] 11:37:57     INFO -  D:/task_174471600302589/build/tests/xpcshell/tests/devtools/client/shared/test/xpcshell/test_curl.js:null:45

Comment 23

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/875d51727bbd
[devtools] Fix Copy As cURL(Windows) on linux r=devtools-reviewers,nchevobbe

Comment 24

[Pulsebot]

Backout by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/fb67bbe47c99
Backed out changeset 875d51727bbd for causing xpcshell failures on test_curl. CLOSED TREE

Comment 25

[Cosmin Sabou [:CosminS]]

Backed out changeset 875d51727bbd for causing xpcshell failures on test_curl

Push with failures

Failure log

Backout link

Comment 26

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ad7e5f6817ce
[devtools] Fix Copy As cURL(Windows) on linux r=devtools-reviewers,nchevobbe

Comment 27

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/ad7e5f6817ce

Comment 28

[Donal Meehan [:dmeehan]]

:bomsy could you please add uplift requests for ESR115 and ESR128

Comment 29

[Hubert Boma Manilla (:bomsy)]

Attachment: Bug 1950001 - [devtools] Fix Copy As cURL(Windows) on linux

Original Revision: https://phabricator.services.mozilla.com/D243110

Comment 30

[Hubert Boma Manilla (:bomsy)]

Attachment: Bug 1950001 - [devtools] Fix Copy As cURL(Windows) on linux

Original Revision: https://phabricator.services.mozilla.com/D243110

Comment 31

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/0b0be2dc8cf0

Comment 32

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/ad9c54269c6f

Comment 33

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/909505d57041

Comment 34

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/c5a5c236b0b9

Comment 35

[Jesse Schwartzentruber (:truber)]

Attachment: advisory.txt

Comment 36

[Jesse Schwartzentruber (:truber)]

Attachment: advisory.txt

Comment 37

[Jesse Schwartzentruber (:truber)]

Attachment: advisory.txt