CVE-2022-31739

What it actually does

Unsanitized percent-encoded environment variables in download filenames on Windows allow path traversal, enabling writes to attacker-controlled locations such as %APPDATA% or %HOMEPATH% instead of the intended download directory.

Why it matters to the business

Attackers can place executable files in user startup or application directories, leading to silent malware execution, persistence, or data tampering on Windows endpoints running vulnerable browsers.

How an attack unfolds

An attacker hosts a page that initiates a file download whose filename contains unescaped variables such as %APPDATA%\malware.exe; when the browser saves the file, Windows expands the variable and writes the payload to a privileged location that the user later executes.

How to fix it

Upgrade Firefox to version 101 or later, Firefox ESR to 91.10 or later, and Thunderbird to 91.10 or later; apply updates through the browser's built-in update mechanism or enterprise deployment channels.

How to confirm the fix worked

Verify installed browser versions meet or exceed the fixed releases; attempt a test download containing a %HOMEPATH% filename on a patched system and confirm the file lands only in the Downloads folder rather than the expanded variable path.

Typical attack path

1. Attacker crafts a malicious webpage or email link that triggers a file download with a filename embedding environment variables
2. Victim opens the page or link in a vulnerable Firefox or Thunderbird instance on Windows
3. Browser performs the download without escaping the % characters, causing the file to be written to an attacker-chosen path
4. Payload is placed in a location that will be executed on next login or application launch
5. Malware runs with the privileges of the logged-in user

How to detect it

Review browser download logs and Windows file-creation events in %APPDATA%, %HOMEPATH%, and startup folders for files whose source is a browser process and whose path contains expanded environment variables; correlate with web-proxy or email logs showing unexpected downloads from untrusted domains.

What your security team should do

• Prioritize immediate update of all Firefox, ESR, and Thunderbird instances on Windows to the fixed releases
• Enable automatic updates and enforce them via enterprise policy where possible
• Monitor endpoint file-creation events in startup and AppData directories for unexpected executables originating from browser downloads