Command Injection in "Copy as cURL (Windows)" feature via ESC character
Categories
(DevTools :: Netmonitor, defect, P2)
Tracking
(Not tracked)
People
(Reporter: 0x999, Assigned: bomsy)
References
(Blocks 1 open bug)
Details
(Keywords: csectype-priv-escalation, reporter-external, sec-moderate, Whiteboard: [client-bounty-form])
Attachments
(1 file)
|
4.23 MB,
video/mp4
|
Details |
Firefox's DevTools "Copy as cURL (Windows)" feature is vulnerable to command injection due to insufficient input sanitization. The feature fails to properly handle the ESC (0x1B) character in request data, which acts as a delimiter in Windows Command Prompt. When this character is followed by a command separator (such as &), an attacker can inject and execute arbitrary commands on the victim's system when the copied cURL command is pasted and executed in cmd.exe.
This issue appears to be affecting Windows 10/11 differently:
-
When Windows 10 (pasted directly into cmd) is used to copy the cURL command and pasted directly into cmd, any portion of the command preceding an ESC (escape) character is discarded. The clipboard instead retains only the data following the ESC character, which can be attacker-controlled. If the ESC is placed within a header, the pasted cURL command will include that header and all subsequent headers however if it appears in the request body, the pasted command will consist solely of the body content after the ESC character - containing any arbitrary command the attacker chooses.
-
When Windows 11 is used to copy the cURL command, the entire cURL command will be copied which (in my POC) will include the ESC character in the request body and act as a delimiter allowing the attacker to use the & character as a separator and execute arbitrary commands.
Windows 10 (pasted into a text editor) - When the same cURL command is copied on Windows 10 but pasted into a text editor (for example, Notepad) instead of cmd, the entire command is preserved - identical to the behavior observed on Windows 11. In this case, the ESC character remains visible within the command, functioning as a delimiter that allows for command injection when executed.
Steps to reproduce:
- Host the attached firefox_ci_esc.html file on your site or navigate to the one hosted on mine (https://0x999.net/pocs/firefox_ci_esc_3463c43d8ab013e43e69e71cbb2f97a8.html)
- Open Devtools by right clicking on the page and click Inspect (or ctrl+shift+i) then select the Network tab
- Click on one of the click me buttons depending on which OS/scenario you are testing
- Right click the /copy-me request in the Network tab and select Copy Value -> Copy as cURL (Windows)
- Paste the copied command into your cmd(or notepad then cmd) and hit Enter to run it
- Observe calc.exe executing
POC:
<html>
<body>
<center>
<button onclick="x1()">click me (windows 10 paste directly in cmd)</button>
<button onclick="x2()">click me (windows 11 paste directly in cmd or windows 10 paste in notepad then in cmd)</button>
</center>
<script>
function x1(){
fetch('/copy-me', {method:'POST', body:'\x1bcalc.exe'})
}
function x2(){
fetch('/copy-me', {method:'POST', body:'\x1b&calc.exe'})
}
</script>
</body>
</html>
Tested Firefox Version: 144.0.2 (64-bit) on Windows 10 Version 10.0.19045 Build 19045 as well as Windows 11.
I've also attached a video POC.
|
||
Updated•9 months ago
|
|
Assignee | |
Updated•9 months ago
|
|
|
Assignee | |
Updated•9 months ago
|
|
||
Updated•9 months ago
|
|
|
Assignee | |
Comment 1•8 months ago
|
||
This would be fixed by Bug 1997018
|
||
Updated•8 months ago
|
|
|
||
Updated•2 months ago
|
Description
•