CVE-2021-43541

What it actually does

Improper escaping of space characters in parameter URLs passed to external protocol handlers allows command injection when a crafted link is processed.

Why it matters to the business

Attackers can execute arbitrary commands on user systems via malicious web links or emails, risking data integrity loss and unauthorized actions without user awareness.

How an attack unfolds

An attacker crafts a URL containing spaces targeting a registered protocol handler, embeds it in content viewed by the victim, and the unescaped parameter is passed directly to the handler invocation, resulting in injected commands being executed.

How to fix it

Upgrade Mozilla Firefox to 95 or later, Firefox ESR to 91.4.0 or later, and Thunderbird to 91.4.0 or later. Apply vendor patches immediately given the command injection nature.

How to confirm the fix worked

Verify installed product versions meet or exceed the fixed releases; test protocol handler invocation with space-containing URLs in a controlled environment to confirm escaping behavior.

Typical attack path

1. Craft malicious link with spaces in protocol handler parameter
2. Deliver link via phishing email, web page, or Thunderbird message
3. Victim clicks or renders the link triggering the protocol handler
4. Unescaped parameter causes command injection in the invoked handler

How to detect it

Search browser and email client logs for protocol handler invocations containing unusual space-delimited parameters or unexpected command strings; correlate with web or email access logs showing suspicious links.

What your security team should do

• Prioritize patching all affected Mozilla instances within 48 hours due to public disclosure and command injection risk
• Block or monitor outbound protocol handler invocations from browsers and email clients where possible
• Educate users on avoiding untrusted links until updates are applied
• Review application allowlists for external protocol handlers