CVE-2023-28163 Path traversal in Firefox
Attackers can exploit environment variable resolution in Windows Save As dialogs to execute code or escalate privileges via malicious filenames.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-28163?
CVE-2023-28163 is a medium-severity path traversal vulnerability in Mozilla Firefox, published on 2 Jun 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user. <br>*This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.*. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9.
Weakness: CWE-22
Which versions are affected by CVE-2023-28163?
It affects 3 products.
Products include Mozilla Firefox, Mozilla Firefox Esr, Mozilla Thunderbird.
How do I fix CVE-2023-28163?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-28163 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-28163 exists.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-xwh8-4fp4-mvqf.