CVE-2024-11693

Overview

Medium

Severity

9.8

CVSS

No

Exploited ITW

Fixed

Fix Status

Impactmoderate

DescriptionThe executable file warning was not presented when downloading .library-ms files. <br>*Note: This issue only affected Windows operating systems. Other operating systems are unaffected.*

ComponentToolkit

Bug ClassLogic Error

Tracker1921458

Fix commit31542b487332 (firefox) +5/-2

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA KEVNot listed

CreditedMarco Bonardo

Disclosed2024-11-26

Background

`.library-ms` file: A Windows Library Description file, an XML document that Windows Explorer parses to define a search/aggregation location, and which can trigger execution or network access when opened.
`ApplicationReputationService`: The Firefox download-protection component that consults Google Safe Browsing and a local extension list to decide whether a downloaded file is potentially dangerous.
`kBinaryFileExtensions`: The reputation service’s table of file extensions considered binary/executable, used to decide which downloads warrant a reputation lookup or warning.
`sExecutableExts`: The shared XPCOM list of extensions treated as executable, consulted by the download UI to present the “this file may harm your computer” executable warning.

Root Cause Analysis

When a file was downloaded, Firefox decided whether to show the executable-file warning and to run reputation checks by matching the file’s extension against curated lists such as sExecutableExts (in nsLocalFileCommon.cpp) and kBinaryFileExtensions (in ApplicationReputation.cpp). The .library-ms extension was absent from both lists, so a downloaded .library-ms file was classified as non-executable and the warning path was never taken, violating the invariant that any format capable of driving code execution or dangerous behavior on the target OS must be enumerated as executable. On Windows, .library-ms files are parsed by Explorer and can be abused to reach a remote resource or otherwise chain into code execution, making the omission security-relevant.

The fix adds .library-ms to sExecutableExts (with the array-size declaration in nsLocalFileCommon.h bumped accordingly) and records it in kBinaryFileExtensions, so the extension is now recognized and the download warning is presented. The corresponding entry in the TestExecutableLists.cpp fixture keeps the gtest verification of the lists in sync.

Key insight

The single mistake was an incomplete allow/deny enumeration: a Windows-executable-capable extension (.library-ms) was missing from the executable-extension lists, and the fix simply adds it so the extension matches the executable-warning and reputation code paths.

Attack Path

Craft a malicious library file An attacker authors a .library-ms XML file that, when opened in Windows Explorer, points at an attacker-controlled or dangerous location.
Deliver via download The attacker gets a victim to download the .library-ms file through Firefox, e.g. via a web link or drive-by prompt.
Extension-list miss Firefox checks the file’s extension against sExecutableExts and kBinaryFileExtensions, both of which lack .library-ms, so it is treated as a benign, non-executable download.
Warning suppressed Because the file is not classified as executable, the “this file is an executable and may harm your computer” warning is never shown and the user is given no dangerous-download signal.
User opens the file The victim opens the downloaded .library-ms file, and Windows Explorer processes it, enabling the attacker’s intended behavior without Firefox having warned the user.

Impact Assessment

An attacker gains the ability to deliver a Windows-executable-capable .library-ms file that bypasses Firefox’s dangerous-download warning, removing a user-facing safety prompt in the browser’s download-handling context. The precondition is that the victim runs Firefox on Windows, downloads the crafted file, and opens it; other operating systems are unaffected because .library-ms is meaningful only to Windows Explorer. The impact is rated moderate: it is a warning-suppression (defense-in-depth) failure rather than direct code execution within the browser.

Files Changed

toolkit/components/reputationservice/ApplicationReputation.cpp
toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
xpcom/io/nsLocalFileCommon.cpp
xpcom/io/nsLocalFileCommon.h

Audit Directions

OS-specific dangerous formats
Review sExecutableExts and kBinaryFileExtensions for other platform-specific extensions (especially Windows shortcut/handler formats like .lnk, .url, .scf, .search-ms) that can drive code execution or network access but may be missing.
List divergence
Cross-check that the multiple executable/binary extension lists (sExecutableExts, kBinaryFileExtensions, and the kTestFileExtensions fixture) stay in sync, since an extension present in one but absent from another produces inconsistent warning behavior.
Hardcoded enumeration completeness
Audit any security decision keyed off a hand-maintained allow/deny list for stale or incomplete entries, and prefer coverage tests or shared single-source tables to prevent a newly weaponized extension from silently bypassing the warning.

Patch

view commit

diff --git a/toolkit/components/reputationservice/ApplicationReputation.cpp b/toolkit/components/reputationservice/ApplicationReputation.cpp
index 4100dddee47..7e956b65e36 100644
--- a/toolkit/components/reputationservice/ApplicationReputation.cpp
+++ b/toolkit/components/reputationservice/ApplicationReputation.cpp
@@ -290,6 +290,7 @@ const char* const ApplicationReputationService::kBinaryFileExtensions[] = {
     //".jse", exec // JScript
     ".ksh",  // Linux shell
     //".lha",
+    //".library-ms", exec // Windows
     //".lnk", exec // Windows
     ".local",  // Windows
     //".lpaq1",
diff --git a/xpcom/io/nsLocalFileCommon.cpp b/xpcom/io/nsLocalFileCommon.cpp
index 7e9d7151c1d..15be3648a78 100644
--- a/xpcom/io/nsLocalFileCommon.cpp
+++ b/xpcom/io/nsLocalFileCommon.cpp
@@ -72,6 +72,7 @@ const char* const sExecutableExts[] = {
 #endif
   ".js",
   ".jse",
+  ".library-ms",  // Windows Library Files
   ".lnk",
   ".mad",         // Access Module Shortcut
   ".maf",         // Access
diff --git a/xpcom/io/nsLocalFileCommon.h b/xpcom/io/nsLocalFileCommon.h
index 96b7e1f06af..cebcb136094 100644
--- a/xpcom/io/nsLocalFileCommon.h
+++ b/xpcom/io/nsLocalFileCommon.h
@@ -8,9 +8,9 @@
 #define _NS_LOCAL_FILE_COMMON_H_
 
 #ifdef MOZ_ESR
-extern const char* const sExecutableExts[108];
-#else
 extern const char* const sExecutableExts[109];
+#else
+extern const char* const sExecutableExts[110];
 #endif
 
 #endif
diff --git a/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
index 2db14aa7430..9e19811169d 100644
--- a/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
+++ b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
@@ -121,6 +121,7 @@ static const char* const kTestFileExtensions[] = {
     ".js",                 // JavaScript script
     ".jse",                // JScript
     ".ksh",                // Linux shell
+    ".library-ms",         // Windows Library Files
     ".lnk",                // Windows
     ".local",              // Windows
     ".mad",                // MS Access

Loading diff…

Regression Test / PoC

shipped with the fix

diff --git a/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
index 2db14aa7430..9e19811169d 100644
--- a/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
+++ b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
@@ -121,6 +121,7 @@ static const char* const kTestFileExtensions[] = {
     ".js",                 // JavaScript script
     ".jse",                // JScript
     ".ksh",                // Linux shell
+    ".library-ms",         // Windows Library Files
     ".lnk",                // Windows
     ".local",              // Windows
     ".mad",                // MS Access

Loading diff…

References

Vendor advisory Fix commit Bug tracker NVD