CVE-2023-23599

What it actually does

Insufficient sanitization of network request data when generating curl command strings in developer tools allows embedded shell metacharacters or command sequences to survive the copy operation, enabling execution of attacker-controlled commands if the resulting curl string is pasted into a shell.

Why it matters to the business

Attackers can trick users into running malicious commands on their systems after interacting with developer tools, leading to potential data theft, malware installation, or unauthorized access on developer or support machines.

How an attack unfolds

An attacker crafts a network response containing hidden command sequences. When a user inspects the request in developer tools and copies it as a curl command, the unsanitized output includes executable shell syntax. Pasting and running the command in a terminal executes the attacker's payload.

How to fix it

Upgrade Mozilla Firefox to version 109 or later, Firefox ESR to 102.7 or later, and Thunderbird to 102.7 or later. Avoid pasting copied curl commands directly into shells without manual inspection until patches are applied.

How to confirm the fix worked

Confirm the browser or mail client reports a version at or above the fixed releases. Test by copying a network request containing shell metacharacters and verifying that dangerous characters are escaped or removed in the generated curl string.

Typical attack path

1. Attacker delivers a specially crafted HTTP response to a target application.
2. User opens developer tools and views the network request.
3. User selects 'Copy as cURL' on the malicious request.
4. User pastes the resulting command into a terminal and executes it.
5. Embedded commands run with the user's privileges.

How to detect it

Review terminal history files, shell logs, and process execution records on developer workstations for unexpected curl invocations containing unusual arguments or chained commands shortly after browser activity.

What your security team should do

• Prioritize patching affected Mozilla products within standard update cycles.
• Educate developers and support staff not to paste copied curl commands directly into terminals.
• Monitor for new Mozilla security advisories and enable automatic updates where possible.