CVE-2022-22756

What it actually does

The vulnerability permits a dragged-and-dropped image object to be transformed into an executable script that executes arbitrary code when the resulting file is opened.

Why it matters to the business

Successful exploitation can result in full compromise of user workstations, enabling data theft, persistence, or further lateral movement with moderate urgency given the age of the flaw and public exploit availability.

How an attack unfolds

An attacker crafts a malicious image, uses social engineering to convince a user to drag it from the browser to the desktop or a folder, the browser fails to preserve the original file type, and the resulting script executes attacker-controlled code when clicked.

How to fix it

Upgrade Mozilla Firefox to version 97 or later, Firefox ESR to 91.6 or later, and Thunderbird to 91.6 or later. Enforce automatic updates where possible and verify installed versions against vendor release notes.

How to confirm the fix worked

Confirm browser and mail client versions meet or exceed the fixed releases; attempt a controlled drag-and-drop of a test image and verify the resulting file remains non-executable.

Typical attack path

1. Attacker hosts a specially crafted image on a web page or sends it via email/attachment
2. User is convinced to drag the image to the desktop or another folder
3. Browser converts the dragged object into an executable script file
4. User double-clicks the resulting file believing it is an image
5. Arbitrary code executes with the privileges of the logged-in user

How to detect it

Review file-creation events in user profile directories and Downloads folders for files whose MIME type or extension changed during drag-and-drop operations; correlate with browser process activity and look for subsequent execution of scripts with image-like names.

• Unexpected .exe, .bat, .cmd, or .scr files created in Desktop or Downloads immediately after browser drag-and-drop events
• File creation events where the original download MIME type was image/* but the final extension is executable

What your security team should do

• Prioritize patching all affected Mozilla products within the next 30 days
• Disable or restrict drag-and-drop from browser windows via enterprise policy where technically feasible
• Conduct user awareness training focused on verifying file extensions before opening downloaded content
• Monitor endpoint logs for unexpected script execution originating from user profile directories