CVE-2022-22744

What it actually does

Improper escaping of the curl command generated by the Copy as curl feature in DevTools allows command injection when the resulting command string is pasted into a PowerShell prompt on Windows.

Why it matters to the business

Windows users of the affected browsers could experience arbitrary command execution leading to data compromise or malware deployment if they paste copied DevTools output into PowerShell; the issue has existed for nearly four years with only marginal increase in exploitation probability and no known ransomware usage.

How an attack unfolds

An attacker supplies specially crafted request data that, when a user inspects the request in DevTools and selects Copy as curl for PowerShell, produces a command containing injected PowerShell syntax; pasting that command into a PowerShell prompt executes the attacker-supplied instructions.

How to fix it

Upgrade Firefox to 96 or later, Firefox ESR to 91.5 or later, and Thunderbird to 91.5 or later; until patches are applied, avoid pasting any Copy as curl output into PowerShell on Windows systems.

How to confirm the fix worked

Confirm installed versions meet or exceed the fixed releases listed above; test the Copy as curl feature with inputs containing PowerShell metacharacters and verify the output is properly escaped or rejected.

Typical attack path

1. Serve or induce a request containing characters that break PowerShell command quoting
2. Trick the victim into opening DevTools and using the Copy as curl feature targeting PowerShell
3. Victim pastes the copied command string into a PowerShell prompt
4. Injected commands execute with the privileges of the PowerShell session

How to detect it

Review PowerShell execution logs and command-line history for strings originating from DevTools curl output; correlate with browser process launches and unusual child processes spawned by powershell.exe.

What your security team should do

• Apply the listed version upgrades to all Windows installations of Firefox, Firefox ESR, and Thunderbird as the highest priority
• Restrict or monitor PowerShell usage for non-administrative users until updates are complete
• Add guidance in internal security awareness materials about the risks of pasting copied command strings