PatchGap
Firefox · Core

CVE-2025-5265

Logic Error in Core
Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionDue to insufficient escaping of the ampersand character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system.<br>*This bug only affects Firefox for Windows. Other versions of Firefox are unaffected.*
ComponentCore
Bug ClassLogic Error
Tracker1962301
Fix commitc035eef75934 (firefox) +12/-2
CISA KEVNot listed
CreditedAmeen Basha M K
Disclosed2025-05-27

Files Changed

  • devtools/client/netmonitor/test/browser_net_curl-utils.js
  • devtools/client/shared/curl.js

Patch

view commit
diff --git a/devtools/client/netmonitor/test/browser_net_curl-utils.js b/devtools/client/netmonitor/test/browser_net_curl-utils.js
index d4157c792cf..ef98d85b15c 100644
--- a/devtools/client/netmonitor/test/browser_net_curl-utils.js
+++ b/devtools/client/netmonitor/test/browser_net_curl-utils.js
@@ -303,6 +303,13 @@ function testEscapeStringPosix() {
     "$'query=evil\\n\\ncmd ^& calc.exe\\n\\n'",
     "The evil command is escaped properly"
   );
+
+  const str = "EvilHeader: &calc.exe&";
+  is(
+    CurlUtils.escapeStringPosix(str),
+    "'EvilHeader: ^&calc.exe^&'",
+    "The evil command is escaped properly"
+  );
 }
 
 function testEscapeStringWin() {
diff --git a/devtools/client/shared/curl.js b/devtools/client/shared/curl.js
index 5f30c411583..2d0f142fd44 100644
--- a/devtools/client/shared/curl.js
+++ b/devtools/client/shared/curl.js
@@ -421,6 +421,9 @@ const CurlUtils = {
       return "\\u" + ("0000" + code).substr(code.length, 4);
     }
 
+    // Escape & and |, which are special characters on Windows.
+    const winSpecialCharsRegEx = /([&\|])/g;
+
     if (/[^\x20-\x7E]|\'/.test(str)) {
       // Use ANSI-C quoting syntax.
       return (
@@ -431,14 +434,14 @@ const CurlUtils = {
           .replace(/\n/g, "\\n")
           .replace(/\r/g, "\\r")
           .replace(/!/g, "\\041")
-          .replace(/([&\|])/g, "^$1")
+          .replace(winSpecialCharsRegEx, "^$1")
           .replace(/[^\x20-\x7E]/g, escapeCharacter) +
         "'"
       );
     }
 
     // Use single quote syntax.
-    return "'" + str + "'";
+    return "'" + str.replace(winSpecialCharsRegEx, "^$1") + "'";
   },
 
   /**
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/devtools/client/netmonitor/test/browser_net_curl-utils.js b/devtools/client/netmonitor/test/browser_net_curl-utils.js
index d4157c792cf..ef98d85b15c 100644
--- a/devtools/client/netmonitor/test/browser_net_curl-utils.js
+++ b/devtools/client/netmonitor/test/browser_net_curl-utils.js
@@ -303,6 +303,13 @@ function testEscapeStringPosix() {
     "$'query=evil\\n\\ncmd ^& calc.exe\\n\\n'",
     "The evil command is escaped properly"
   );
+
+  const str = "EvilHeader: &calc.exe&";
+  is(
+    CurlUtils.escapeStringPosix(str),
+    "'EvilHeader: ^&calc.exe^&'",
+    "The evil command is escaped properly"
+  );
 }
 
 function testEscapeStringWin() {
Loading diff…
On This Page