1964385 - (CVE-2025-6426) MacOS Download protection bypass With Terminal File

Status: VERIFIED FIXED

(Firefox :: File Handling, defect, P1)

Description

[pwn2car]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Steps to reproduce:

The .terminal file extension is natively supported by Apple. When a .terminal file is opened, it launches the Terminal.app and executes the command specified within the file.

For example, consider the following test.terminal file:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>CommandString</key>
    <string>id</string>
    <key>ProfileCurrentVersion</key>
    <real>2.1</real>
    <key>RunCommandAsShell</key>
    <false/>
    <key>name</key>
    <string>exploit</string>
    <key>type</key>
    <string>Window Settings</string>
</dict>
</plist>

Previously reported cases like fileloc (Bug 1596668) and inetloc (Bug 1731779) could launch .app files but were limited in their ability to execute arbitrary commands.

In contrast, .terminal files can not only execute scripts but also allow passing arguments to them, potentially expanding the attack surface or automation capabilities.

Comment 1

[Daniel Veditz [:dveditz]]

Attachment: test.terminal

Comment 2

[Daniel Veditz [:dveditz]]

Does Mac's "Gatekeeper" not warn about downloaded .terminal files? Does it ignore them because they're "just" .bat-file like and not actual "applications"?

We should treat these as dangerous anyway, but seems like Apple has some responsibility too

Comment 3

[:Gijs (he/him)]

Attachment: Bug 1964385 - improve handling of .terminal files, r?mak

Comment 4

[:Gijs (he/him)]

Attachment: Bug 1964385 - improve handling of .terminal files, r?mak

Original Revision: https://phabricator.services.mozilla.com/D250229

Comment 5

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined: security impact
• Code covered by automated testing: yes
• Fix verified in Nightly: no
• Needs manual QE test: yes
• Steps to reproduce for manual QE testing: see comment 0. Expected result is that there's a warning before opening the file.
• Risk associated with taking this patch: Low
• Explanation of risk level: We have lists of problematic extensions and this is just a small addition to that list
• String changes made/needed: No
• Is Android affected?: no

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/46729af4eff5
https://hg.mozilla.org/integration/autoland/rev/48adeaa0c7dc
improve handling of .terminal files, r=mak,dimi

Comment 7

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/48adeaa0c7dc

Comment 8

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/6572b0099c5e
https://hg.mozilla.org/releases/mozilla-beta/rev/557204d5da85

Comment 9

[Catalin Sasca, Desktop Test Engineering [:csasca]]

Reproduced it on Firefox 140.0a1 (2025-05-05) on macOS 15.5 by following the infos provided in Comment 0.

The warning prompt is present on Firefox 140.0b4 (treeherder build) and Firefox 141.0a1 (2025-06-01) on the same system.

Comment 10

[Ryan VanderMeulen [:RyanVM]]

Please nominate this for ESR128 also. It grafts cleanly.

Comment 11

[:Gijs (he/him)]

Attachment: Bug 1964385 - improve handling of .terminal files, r?mak

Original Revision: https://phabricator.services.mozilla.com/D250229

Comment 12

[Phabricator Automation]

firefox-esr128 Uplift Approval Request

• User impact if declined: dodgy terminal downloads
• Code covered by automated testing: no
• Fix verified in Nightly: yes
• Needs manual QE test: yes
• Steps to reproduce for manual QE testing: see comment 0. Expected result is that there's a warning before opening the file.
• Risk associated with taking this patch: Low
• Explanation of risk level: We have lists of problematic extensions and this is just a small addition to that list
• String changes made/needed: No
• Is Android affected?: no

Comment 13

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/70d8358b8646

Comment 14

[Catalin Sasca, Desktop Test Engineering [:csasca]]

Verified that the prompt is shown on Firefox 128.12.0esr (treeherder build) on macOS 15.5.

Comment 15

[Tom Ritter [:tjr] (OOTO until April)]

Attachment: advisory.txt

Comment 16

[pwn2car]

Is there a Bounty?