PatchGap
Firefox · Core

CVE-2025-4089

Logic Error in Core
Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionDue to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system.
ComponentCore
Bug ClassLogic Error
Tracker1949994
Fix commit94a9acebe31f (firefox) +9/-0
CISA KEVNot listed
CreditedAmeen Basha M K
Disclosed2025-04-29

Files Changed

  • devtools/client/netmonitor/test/browser_net_curl-utils.js
  • devtools/client/shared/curl.js

Patch

view commit
diff --git a/devtools/client/netmonitor/test/browser_net_curl-utils.js b/devtools/client/netmonitor/test/browser_net_curl-utils.js
index cdf64ad5f95..17452405eda 100644
--- a/devtools/client/netmonitor/test/browser_net_curl-utils.js
+++ b/devtools/client/netmonitor/test/browser_net_curl-utils.js
@@ -295,6 +295,14 @@ function testEscapeStringPosix() {
     "$'\\xc3\\xa6 \\xc3\\xb8 \\xc3\\xbc \\xc3\\x9f \\xc3\\xb6 \\xc3\\xa9'",
     "Character codes outside of the decimal range 32 - 126 should be escaped."
   );
+
+  // Assert that ampersands are correctly escaped in case its tried to run on Windows
+  const evilCommand = `query=evil\n\ncmd & calc.exe\n\n`;
+  is(
+    CurlUtils.escapeStringPosix(evilCommand),
+    "$'query=evil\\n\\ncmd ^& calc.exe\\n\\n'",
+    "The evil command is escaped properly"
+  );
 }
 
 function testEscapeStringWin() {
diff --git a/devtools/client/shared/curl.js b/devtools/client/shared/curl.js
index 47d2aacfe81..0af5a608cb2 100644
--- a/devtools/client/shared/curl.js
+++ b/devtools/client/shared/curl.js
@@ -424,6 +424,7 @@ const CurlUtils = {
           .replace(/\n/g, "\\n")
           .replace(/\r/g, "\\r")
           .replace(/!/g, "\\041")
+          .replace(/&/g, "^&")
           .replace(/[^\x20-\x7E]/g, escapeCharacter) +
         "'"
       );
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/devtools/client/netmonitor/test/browser_net_curl-utils.js b/devtools/client/netmonitor/test/browser_net_curl-utils.js
index cdf64ad5f95..17452405eda 100644
--- a/devtools/client/netmonitor/test/browser_net_curl-utils.js
+++ b/devtools/client/netmonitor/test/browser_net_curl-utils.js
@@ -295,6 +295,14 @@ function testEscapeStringPosix() {
     "$'\\xc3\\xa6 \\xc3\\xb8 \\xc3\\xbc \\xc3\\x9f \\xc3\\xb6 \\xc3\\xa9'",
     "Character codes outside of the decimal range 32 - 126 should be escaped."
   );
+
+  // Assert that ampersands are correctly escaped in case its tried to run on Windows
+  const evilCommand = `query=evil\n\ncmd & calc.exe\n\n`;
+  is(
+    CurlUtils.escapeStringPosix(evilCommand),
+    "$'query=evil\\n\\ncmd ^& calc.exe\\n\\n'",
+    "The evil command is escaped properly"
+  );
 }
 
 function testEscapeStringWin() {
Loading diff…
On This Page