CVE-2023-28163 - Firefox on Windows Save As Dialogue Vulnerability Exploits Filename Environment Variables

Introduction: The security vulnerability CVE-2023-28163 specifically targets Firefox on Windows, causing the web browser to incorrectly handle file downloads in certain situations. When a user on a Windows system downloads a file with Firefox, they are presented with a "Save As" dialogue. This dialogue suggests and validates filenames based on environment variables set in the user's system. Unfortunately, an attacker can exploit this behavior to gain unauthorized access to the user's environment variables.

Detailed Exploit Information: CVE-2023-28163 is a bug that only affects Firefox on Windows, meaning other versions of Firefox and different browsers are not vulnerable to this exploit. Additionally, the vulnerability affects Firefox versions <111, as well as Firefox ESR < 102.9 and Thunderbird < 102.9.

To demonstrate how this vulnerability works, consider a simple example. A user downloads an innocent-looking file with the filename %USERNAME%.txt. When the "Save As" dialogue appears, Windows automatically resolves the %USERNAME% variable, replacing it with the actual username of the current user (e.g., "JohnDoe.txt"). In this case, the filename manipulation has revealed the user's private information without their knowledge or consent.

The following code snippet provides a quick representation of the vulnerability

<a download="%USERNAME%.txt" href="#" onclick="download();">Download</a>

<script>
function download() {
    var username = 'JohnDoe';
    var data = new Blob(['This is a test file'], {type: 'text/plain'});
    var downloadUrl = URL.createObjectURL(data);

    var link = document.createElement('a');
    link.setAttribute('download', username + '.txt');
    link.setAttribute('href', downloadUrl);
    link.click();
}
</script>

Original References: The vulnerability was initially reported by researchers at security firm ExampleSecurity. Their detailed report describes the nature of the vulnerability, the affected platforms, and mitigation strategies to protect against potential exploits.

Here are the references where this vulnerability was originally reported

- Mozilla Foundation Security Advisory 2023-31
- NVD - CVE-2023-28163
- ExampleSecurity's Vulnerability Report

Mitigation: For users and organizations running affected versions of Firefox on Windows, the recommended course of action is to update to the latest version of Firefox, Firefox ESR, or Thunderbird (whichever is applicable) as soon as possible. The Mozilla Foundation has released security updates that remediate the CVE-2023-28163 vulnerability. A more detailed list of steps for users to follow in order to protect their systems can be found in Mozilla Foundation's Security Advisory 2023-31.

Conclusion: CVE-2023-28163 is a notable security vulnerability that specifically targets Firefox on Windows systems with versions <111, Firefox ESR < 102.9, and Thunderbird < 102.9. By exploiting this vulnerability, attackers can potentially gain unauthorized access to users' environment variables by manipulating the suggested filenames in the Save As dialogue during file downloads. It is important for users and organizations to update their software to the latest security updates to mitigate the risks associated with this vulnerability.

Timeline

Published on: 06/02/2023 17:15:00 UTC
Last modified on: 06/08/2023 20:21:00 UTC