Mozilla Firefox up to 65.x on MacOS Developer Tools os command injection

Summaryinfo

A vulnerability was found in Mozilla Firefox up to 65.x on MacOS. It has been declared as critical. Affected by this issue is some unknown functionality of the component Developer Tools. Such manipulation leads to os command injection. This vulnerability is listed as CVE-2019-9804. The attack must be carried out locally. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Mozilla Firefox up to 65.x on MacOS (Web Browser) and classified as critical. Affected by this issue is some unknown processing of the component Developer Tools. The manipulation with an unknown input leads to a os command injection vulnerability. Using CWE to declare the problem leads to CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

In Firefox Developer Tools it is possible that pasting the result of the 'Copy as cURL' command into a command shell on macOS will cause the execution of unintended additional bash script commands if the URL was maliciously crafted. This is the result of an issue with the native version of Bash on macOS. *Note: This issue only affects macOS. Other operating systems are unaffected.*. This vulnerability affects Firefox < 66.

The bug was discovered 03/19/2019. The weakness was presented 04/26/2019. This vulnerability is handled as CVE-2019-9804 since 03/14/2019. The attack needs to be approached locally. Required for exploitation is a simple authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1202.

The vulnerability was handled as a non-public zero-day exploit for at least 38 days. During that time the estimated underground price was around $5k-$25k.

Upgrading to version 66.0 eliminates this vulnerability.

See VDB-134172, VDB-134171, VDB-134170 and VDB-134169 for similar entries. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Web Browser

Vendor

• Mozilla

Name

• Firefox

Version

• 65.x

License

• open-source

Website

• Vendor: https://www.mozilla.org/
• Product: https://www.mozilla.org/en-US/firefox/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion