2007829 - (CVE-2026-2780) Argument injection in the Copy as cURL for Windows allows arbitrary file read/write upon execution of the copied command

Status: RESOLVED FIXED

(DevTools :: Netmonitor, defect, P2)

Description

[RyotaK]

Attachment: test.html

Summary

Firefox has a feature to copy the cURL command that reproduces the request sent in the browser. Two types of cURL commands can be generated on Windows; Windows and POSIX.

The Windows type of cURL command is expected to be executed in the command prompt, which has the separated parser from the cURL's argument parser (The one from Microsoft CRT).

To escape the request for both parsers, Firefox implements a complicated escape function in the following place:

https://searchfox.org/firefox-main/rev/5fcab02dad8c5bcae4c486d71b27f7e6a67e4d57/devtools/client/shared/curl.js#448-493

While it attempts to escape the string for the Microsoft CRT parser by replacing the " into \", it doesn't escape the \ character itself.

Therefore, by embedding the \" into the request, the above escape function escapes it into \\", which fails to escape the double quote character.

For example, if the request body is \" --help, it will generate the following command:

--data-raw "\\" --help "

Once the above command is parsed by cURL, it will recognize the --help argument and shows the help instead of sending the request.

Impact

An attacker who can trick the victim into copying the cURL command for a malicious request is able to inject arbitrary cURL arguments. By using the --output option or --upload-file option, an attacker can achieve arbitrary file read/write.

Steps to reproduce

This PoC will send the content of C:\Windows\win.ini to ryotak.net.

1. Download test.html attached.
2. Open it in the Firefox.
3. Open DevTools and navigate to the Network tab.
4. Click the Send a request button.
5. Copy the request with Copy as cURL (Windows).
6. Execute it in the command prompt and observe that the content of C:\Windows\win.ini is sent to ryotak.net.

Tested version

Firefox Nightly 148.0a1 (2025-12-27) (64-bit)

Windows 11 24H2 (OS Build 26100.4652)

Comment 1

[Hubert Boma Manilla (:bomsy)]

Attachment: (secure)

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/48389b47510c
https://hg.mozilla.org/integration/autoland/rev/fce65d7d8a35
[devtools] Escape the slashes properly r=devtools-reviewers,ochameau

Comment 3

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/fce65d7d8a35

Comment 4

[Donal Meehan [:dmeehan]]

:bomsy, please add uplift requests when you have a moment. It grafts cleanly for ESR140 and Beta.

Comment 5

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined: Security vulnerability for devtools users
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: Small JS string replace to escape slashes
• String changes made/needed: None
• Is Android affected?: no

Comment 6

[Hubert Boma Manilla (:bomsy)]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D278460

Comment 7

[Hubert Boma Manilla (:bomsy)]

Done. Thanks Donal.

Comment 8

[Hubert Boma Manilla (:bomsy)]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D278460

Comment 9

[Phabricator Automation]

firefox-esr140 Uplift Approval Request

• User impact if declined: Security vulnerability for devtools users
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: Small JS string replace to escape slashes
• String changes made/needed: None
• Is Android affected?: no

Comment 10

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/9fa2474a736a
https://hg.mozilla.org/releases/mozilla-beta/rev/c19dcb03da35

Comment 11

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/fdec8a0b7833
https://hg.mozilla.org/releases/mozilla-beta/rev/009d8b379400

Comment 12

[Hubert Boma Manilla (:bomsy)]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D278460

Comment 13

[Phabricator Automation]

firefox-esr140 Uplift Approval Request

• User impact if declined: Security vulnerability for devtools users
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: Small JS string replace to escape slashes
• String changes made/needed: None
• Is Android affected?: no

Comment 14

[Donal Meehan [:dmeehan]]

Comment on attachment 9536600 [details]
(secure)

Approved for 140.8esr