1956698 - [Mac] Copy as powershell (on curl) leads to code execution on mac

Status: RESOLVED FIXED

(DevTools :: Netmonitor, defect)

Description

[Ameen Basha M K]

HI team, Firefox latest on mac is vulnerable for code execution, which allows the attacker to trick the user with malicious request to copy as powershell and run it on mac leads to code execution

Note: HTTP method is vulnerable part of the resultant curl.

FYI: we can install the powershell in mac via homebrew (instead of moving to windows, i have used this to run powershell command on mac) - Same possible on directly running in windows powershell too

Fetch Command: (run it on console)
fetch('',{method: '||whoami||'});

Steps to reproduce

1. run the above command in browser console (we can achieve this via html file itself)
2. copy the request as powershell
3. paste and run it on powershell
4. you can see the output of whoami command

Note: Issue tested on latest version of firefox

I will attached the poc video for reference shortly

Comment 1

[Ameen Basha M K]

Attachment: [Mac]Firefox-Copyascurl(powershell)-CodeExecution.mp4

Comment 2

[Daniel Veditz [:dveditz]]

Where did you find a Mac version of Powershell to paste the command into?

Comment 3

[Daniel Veditz [:dveditz]]

When I tried to paste the "copy as powershell" string into the standard Mac bash terminal, lines were executed immediately upon pasting—didn't even have to hit "enter". It didn't run the embedded whoami command and basically just returned a bunch of syntax errors, but it's quite believable someone could find the right combination to get something executed.

Comment 4

[Ameen Basha M K]

(In reply to Daniel Veditz [:dveditz] from comment #2)

Where did you find a Mac version of Powershell to paste the command into?

Microsoft provides a documentation for this

Ref: https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell-on-macos?view=powershell-7.5

I have installed using homebrew method

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1795595

Comment 6

[Ameen Basha M K]

https://searchfox.org/mozilla-central/source/devtools/client/netmonitor/src/utils/powershell.js#89

I hope this is the vulnerable place which cause this issue, Similar to body, headers use escapeStr for method too

parameters.push(-Method ${method}); => parameters.push(-Method ${escapeStr(method)});

Comment 7

[Hubert Boma Manilla (:bomsy)]

Attachment: Bug 1956698 - [devtools] Escape the method value r=#devtools

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1795595

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7c67a571c098
[devtools] Escape the method value r=devtools-reviewers,nchevobbe

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/7c67a571c098

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:bomsy, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox138 to wontfix.

For more information, please visit BugBot documentation.

Comment 12

[Hubert Boma Manilla (:bomsy)]

Comment on attachment 9476034 [details]
Bug 1956698 - [devtools] Escape the method value r=#devtools

Beta/Release Uplift Approval Request

• User impact if declined/Reason for urgency: Security issue with curl command for powershell on Mac
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Small Javascript to escape HTTP Methods properly
• String changes made/needed:
• Is Android affected?: No

Comment 13

[Dianna Smith [:diannaS]]

Comment on attachment 9476034 [details]
Bug 1956698 - [devtools] Escape the method value r=#devtools

Approved for 138.0b5

Comment 14

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/6b0e92fa19b6

Comment 15

[Ryan VanderMeulen [:RyanVM]]

Please nominate this for ESR128 uplift also when you get a chance.

Comment 16

[Hubert Boma Manilla (:bomsy)]

Comment on attachment 9476034 [details]
Bug 1956698 - [devtools] Escape the method value r=#devtools

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: This is a security bug
• User impact if declined: Malicious code can be run on user machine
• Fix Landed on Version: 139
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Small JS fix to escape HTTP methods when generating a Curl command for porwershell

Comment 17

[Dianna Smith [:diannaS]]

Comment on attachment 9476034 [details]
Bug 1956698 - [devtools] Escape the method value r=#devtools

Approved for 128.10esr

Comment 18

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/2817f1ac979b

Comment 19

[Jason Kratzer [:jkratzer]]

Attachment: advisory.txt

Comment 20

[Jason Kratzer [:jkratzer]]

Attachment: advisory.txt

Comment 21

[Jason Kratzer [:jkratzer]]

Attachment: advisory.txt