CVE-2022-34482

What it actually does

The flaw permits an attacker-controlled filename supplied during a drag-and-drop operation to retain or acquire an executable extension, allowing the resulting file on disk to be treated as a directly executable binary instead of the intended image type.

Why it matters to the business

Successful exploitation can result in arbitrary code execution on user workstations, enabling malware deployment, credential theft, or lateral movement; with thousands of days since disclosure and stable low exploit probability, the primary risk is to unpatched browser fleets in environments where users routinely handle external files.

How an attack unfolds

An attacker prepares a file whose name ends with an executable extension, socially engineers a victim into dragging and dropping the file from the browser onto the local filesystem, and then convinces the user to open the resulting executable, achieving code execution without additional browser sandbox escapes.

How to fix it

Upgrade Mozilla Firefox to version 102 or later on all endpoints; enforce automatic updates where possible and verify that drag-and-drop filename sanitization prevents executable extensions.

How to confirm the fix worked

Confirm installed Firefox version is 102 or newer; attempt controlled drag-and-drop of test files with executable extensions and verify the resulting filename is sanitized or blocked from direct execution.

Typical attack path

1. Craft or rename a payload file so its name contains an executable extension
2. Host or deliver the file via a web page or download link
3. Convince the user to perform a drag-and-drop action from the browser to the desktop or folder
4. Trick the user into launching the file that now carries the executable extension
5. Execute attacker-supplied code on the victim system

How to detect it

Review endpoint and browser logs for file-creation events immediately following drag-and-drop actions from web content; correlate with subsequent execution of files bearing mismatched extensions.

What your security team should do

• Immediately deploy Firefox 102+ across the enterprise
• Disable or restrict drag-and-drop of files from untrusted web origins via policy
• Conduct user awareness training on verifying file extensions before execution
• Monitor endpoint logs for unexpected executables created shortly after browser file operations