CVE-2017-17512

What it actually does

The flaw permits argument injection into the browser command launched from the BROWSER environment variable because sensible-browser performs no validation or sanitization of the provided string before execution.

Why it matters to the business

Attackers can abuse applications that invoke the browser helper to run arbitrary commands or alter browser behavior, potentially leading to data theft or further compromise on systems that still ship the vulnerable package.

How an attack unfolds

An attacker supplies a crafted URL containing browser arguments such as --proxy-pac-file to a program that calls sensible-browser; the helper expands the BROWSER variable and passes the attacker-controlled arguments directly to the browser binary, achieving command-line injection.

How to fix it

Upgrade sensible-utils to version 0.0.11 or later, which adds proper validation of the BROWSER variable contents before launching any command.

How to confirm the fix worked

Confirm the installed package version is at least 0.0.11; test by setting BROWSER to a benign command and invoking sensible-browser with a URL containing an argument flag to verify the argument is rejected rather than passed through.

Typical attack path

1. Identify an application or script on the target that invokes sensible-browser with a user-supplied or attacker-controlled URL.
2. Craft a malicious URL embedding desired browser arguments or command fragments.
3. Cause the target application to call sensible-browser with the crafted URL.
4. The unsanitized BROWSER variable expansion executes the injected arguments, achieving the attacker's objective.

How to detect it

Review process execution logs and command-line histories for invocations of sensible-browser that contain unexpected browser flags such as --proxy-pac-file; examine any application logs that record URLs passed to browser helpers.

What your security team should do

• Immediately upgrade sensible-utils to 0.0.11 or newer on all systems.
• Audit scripts and applications that call sensible-browser or rely on the BROWSER variable and replace them with safer alternatives where possible.
• Monitor package repositories for any remaining downstream dependents that have not yet incorporated the fixed version.