CVE-2023-23599 Malicious command could be hidden in devtools output on Windows
Attackers can hide malicious commands in copied curl outputs from developer tools, potentially leading to arbitrary code execution on Windows.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-23599?
CVE-2023-23599 is a medium-severity command injection vulnerability in Mozilla Firefox, published on 2 Jun 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within. This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7.
Weakness: CWE-116
Which versions are affected by CVE-2023-23599?
It affects 3 products.
Products include Mozilla Firefox, Mozilla Firefox Esr, Mozilla Thunderbird.
How do I fix CVE-2023-23599?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-23599 being exploited?
There is no known exploitation of CVE-2023-23599 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-x86f-c5g7-4mrq, UBUNTU-CVE-2023-23599.