Command Injection in "Copy as cURL (Windows)" feature via Nullbyte
Categories
(DevTools :: Netmonitor, defect, P2)
Tracking
(Not tracked)
People
(Reporter: 0x999, Unassigned)
References
(Blocks 1 open bug)
Details
(Keywords: csectype-priv-escalation, reporter-external, sec-moderate, Whiteboard: [client-bounty-form])
Attachments
(1 file)
|
2.41 MB,
video/mp4
|
Details |
Firefox's "Copy as cURL (Windows)" feature is vulnerable to a command injection vulnerability due to insufficient input sanitization.
The feature fails to sanitize the Nullbyte character in request data. While command separators (such as &) are correctly being escaped using a caret (^), when a nullbyte character is used before the separator the nullbyte character is also being escaped using a caret which results in the escaping character to be escaped and the & symbol to be interpreted as a command separator, using this an attacker can inject and execute arbitrary commands on the victim's system when the copied cURL command is pasted and executed in cmd.exe.
Steps to reproduce:
- Host the attached firefox_ci_nb.html file on your site or navigate to the one hosted on mine (https://0x999.net/pocs/firefox_ci_nb_5bbd343accb272c50f41e50544a0654e.html)
- Open devtools by right clicking on the page and click Inspect (or ctrl+shift+i) then select the Network tab
- Click on the click me button
- Right click the /copy-me request in the Network tab and select Copy Value -> Copy as cURL (Windows)
- Paste the copied command into your cmd and hit Enter to run it
- Observe calc.exe executing
POC:
<html>
<body>
<center><button onclick="x()">click me</button></center>
<script>
function x(){
fetch('/copy-me', {method:'POST', body:'\x00&calc.exe'})
}
</script>
</body>
</html>
Tested Firefox Version: 144.0.2 (64-bit) on Windows 10 Version 10.0.19045 Build 19045 as well as Windows 11
I've also attached a video POC
|
||
Updated•9 months ago
|
|
||
Updated•9 months ago
|
|
||
Updated•9 months ago
|
|
|
||
Comment 1•8 months ago
|
||
This would be fixed by Bug 1997018
|
||
Updated•8 months ago
|
|
|
||
Updated•2 months ago
|
Description
•