OS Command Injection in Mozilla Firefox and Firefox ESR - CVE-2022-22744

Vulnerability identifier: #VU59378

CSH Severity: Low

CVSS v4: 7.4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-22744

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the "Copy as curl" feature in DevTools. A remote attacker can trick the victim to cope a specially crafted link and execute arbitrary commands on the system, if copied data is pasted into a Powershell prompt.

Mozilla Firefox
Firefox ESR
Pale Moon
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
SUSE OpenStack Cloud Crowbar
HPE Helion Openstack
SUSE OpenStack Cloud
SUSE Linux Enterprise Debuginfo
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Desktop Applications
Mozilla Thunderbird
MozillaFirefox-debuginfo
MozillaFirefox-translations-other
MozillaFirefox-translations-common
MozillaFirefox
MozillaFirefox-devel
MozillaFirefox-debugsource

Install updates from vendor's website.

Mozilla Firefox - update to 96.0
Firefox ESR - update to 91.5.0
Pale Moon - update to 29.4.4
Mozilla Thunderbird - update to 91.5.0
MozillaFirefox-debuginfo - addressed in versions 91.5.0-78.159.1, 91.5.0-112.86.1, 91.5.0-150.15.1, 91.5.0-152.12.1
MozillaFirefox-translations-other - addressed in versions 91.5.0-78.159.1, 91.5.0-150.15.1, 91.5.0-152.12.1
MozillaFirefox-translations-common - addressed in versions 91.5.0-78.159.1, 91.5.0-112.86.1, 91.5.0-150.15.1, 91.5.0-152.12.1
MozillaFirefox - addressed in versions 91.5.0-78.159.1, 91.5.0-112.86.1, 91.5.0-150.15.1, 91.5.0-152.12.1
MozillaFirefox-devel - addressed in versions 91.5.0-112.86.1, 91.5.0-150.15.1, 91.5.0-152.12.1
MozillaFirefox-debugsource - addressed in versions 91.5.0-112.86.1, 91.5.0-150.15.1, 91.5.0-152.12.1

• https://www.mozilla.org/en-US/security/advisories/mfsa2022-01/
• https://www.mozilla.org/en-US/security/advisories/mfsa2022-02/

• Multiple vulnerabilities in Mozilla Firefox
• Multiple vulnerabilities in Mozilla Thunderbird
• SUSE update for MozillaFirefox
• Multiple vulnerabilities in Pale Moon
• SUSE update for MozillaFirefox
• SUSE update for MozillaFirefox
• SUSE update for MozillaFirefox