CVE-2025-12907
Overview
Files Changed
AUTHORSfront_end/panels/network/NetworkLogView.ts
Patch
From 553969206ce9e85d4f11dbe4756ddcfd1366e731 Mon Sep 17 00:00:00 2001
From: Ameen <ameenbasha111@gmail.com>
Date: Tue, 22 Jul 2025 16:33:11 +0530
Subject: [PATCH] [DevTools] Sanitize special whitespace in "Copy as cURL (cmd)"
The escapeStringWin function did not properly sanitize special
whitespace characters (e.g., tabs, vertical tabs), which are
treated as delimiters by the Windows command prompt.
This change sanitizes all whitespace characters (other than normal space), which closes the vulnerability.
Bug: 427367145
Change-Id: If1f1be803a4b4a20a93b6982247eaf9cbebaf6ce
Reviewed-on: https://chromium-review.googlesource.com/c/devtools/devtools-frontend/+/6746171
Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Danil Somsikov <dsv@chromium.org>
Commit-Queue: Danil Somsikov <dsv@chromium.org>
---
diff --git a/AUTHORS b/AUTHORS
index 2de9dac..7061bb3 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -16,6 +16,7 @@
Alesandro Ortiz <alesandro@alesandroortiz.com>
Alexander Stammbach <alexander@stammbach.io>
Alexey Rodionov <fluorescent.hallucinogen@gmail.com>
+Ameen Basha <ameenbasha111@gmail.com>
Ankit Mishra <ankit.mishra131990@gmail.com>
Anna Agoha <annaagoha@gmail.com>
Anthony Xie <anthonyxie64@gmail.com>
diff --git a/front_end/panels/network/NetworkLogView.ts b/front_end/panels/network/NetworkLogView.ts
index e44d26f..27d1648 100644
--- a/front_end/panels/network/NetworkLogView.ts
+++ b/front_end/panels/network/NetworkLogView.ts
@@ -2337,6 +2337,7 @@
.replace(/"/g, '\\"')
.replace(/[^a-zA-Z0-9\s_\-:=+~'\/.',?;()*`]/g, '^$&')
.replace(/%(?=[a-zA-Z0-9_])/g, '%^')
+ .replace(/[^\S \r\n]/g, '^$&')
.replace(/\r?\n|\r/g, '^\n\n') +
encapsChars;
}
Original Bug Report
Command injection in "Copy as cURL (cmd)" due to improper sanitization
Steps to reproduce the problem
- Open the poc html in chrome
- open network teab and copy the requests with - copy all as curl (cmd) feature
- paste the command on cmd you can see the calc popup
Problem Description
A command injection vulnerability exists in the DevTools “Copy as cURL (cmd)” feature on Windows. The current implementation correctly handles carriage returns (\r) but fails to sanitize the tab character (\t).
The cmd.exe shell interprets the tab character as a delimiter, similar to a space. By injecting a payload containing a tab followed by a command separator (e.g., &) and a newline sequence, an attacker can break out of the intended cURL argument and execute arbitrary commands when the copied text is pasted into a Windows command prompt.
This is a bypass of a previous security fix that only addressed newline characters.
Additional Comments
Security Impact: This vulnerability allows for arbitrary code execution on a user’s machine. If a user is tricked into pasting a crafted cURL command from a malicious source, the attacker can execute commands with the user’s privileges.
Note: I have attached the poc video and html file for reference
Summary
Command injection in “Copy as cURL (cmd)” due to improper sanitization
Custom Questions
Reporter credit:
Ameen Basha M K
Additional Data
Category: Security
Chrome Channel: Canary
Regression: N/A \