CVE-2022-34483

What it actually does

Improper input validation during drag-and-drop image handling allows an attacker-controlled filename to retain or receive an executable extension when saved to the local filesystem.

Why it matters to the business

Users may be tricked into executing malicious code disguised as an image file, leading to malware infection, data theft, or unauthorized system access across the organization.

How an attack unfolds

An attacker crafts or hosts content that, when a user is socially engineered to drag and drop an image to the filesystem, results in a saved file with an executable extension; the user is then prompted or tricked into running the file, executing attacker-supplied code.

How to fix it

Upgrade all affected Mozilla Firefox installations to version 102 or later.

How to confirm the fix worked

Verify Firefox version is 102 or higher; confirm that drag-and-drop of images no longer permits executable extensions in the saved filename.

Typical attack path

1. Host or deliver content that triggers the drag-and-drop filename manipulation
2. Social-engineer the user into performing the drag-and-drop action
3. Induce the user to save or accept the resulting file with an executable extension
4. Trick the user into executing the saved file

How to detect it

Review browser download and execution logs for files saved via drag-and-drop that carry executable extensions; correlate with subsequent process launches from user profile directories.

What your security team should do

• Immediately upgrade all Firefox instances to version 102 or newer
• Enforce application allow-listing to block execution of unexpected file types
• Conduct user awareness training on verifying file extensions before execution