Cloudanix VulnDB

CVE-2023-25731

High · 8.8

CVSS

8.8

EPSS

0.6%

Published

Jun 2, 2023

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in how a browser tool handles web addresses could let attackers take over the browser if someone visits a specially crafted link.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Full Compromise
Component
Application
Class
Improper Input Validation
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

Improper storage of URLs in developer tools network panel allows query parameters to overwrite global objects in privileged code.

Why it matters to the business

Attackers could execute arbitrary code or access sensitive data through the browser, leading to system compromise, data theft, and operational disruption; the vulnerability has been public for over three years with low but stable exploit probability.

How an attack unfolds

An attacker crafts a malicious URL containing specially formatted query parameters and delivers it to a target user; when the user opens the URL in an affected Firefox version while the network panel is active, the parameters overwrite global objects allowing privileged code execution.

How to fix it

Upgrade Firefox to version 110 or later. For gerbv on Debian 13 update to 2.10.0-1; for gerbv source update to commit 5517e22250e935dc7f86f64ad414aeae3dbcb36a.

How to confirm the fix worked

Verify installed Firefox or gerbv version is at or above the listed fixed versions and confirm the network panel no longer stores URLs in a manner that permits global object overwrite.

Typical attack path

  1. Craft malicious URL with query parameters designed to overwrite globals
  2. Deliver link via phishing email, website, or other social engineering
  3. Victim opens URL in vulnerable Firefox with developer tools network panel active
  4. Query parameters trigger overwrite of global objects in privileged context
  5. Attacker gains ability to execute code or manipulate browser behavior

How to detect it

Review browser process logs and network activity for unexpected global object modifications or unusual query parameter patterns that match developer tools network panel interactions.

What your security team should do

  • Prioritize patching all instances of affected Firefox and gerbv software within the next 30 days given the long public disclosure window
  • Disable developer tools for non-developer users where feasible
  • Review and restrict use of network panel in production or high-risk environments

The record

Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite global objects in privileged code. This vulnerability affects Firefox < 110.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:18.04:LTS firefox 0 110.0+build3-0ubuntu0.18.04.1
Ubuntu:18.04:LTS mozjs38 0 No fix
Ubuntu:18.04:LTS mozjs52 0 No fix
Ubuntu:20.04:LTS firefox 0 110.0+build3-0ubuntu0.20.04.1
Ubuntu:20.04:LTS mozjs52 0 No fix
Ubuntu:20.04:LTS mozjs68 0 No fix
Ubuntu:22.04:LTS mozjs78 0 No fix
Ubuntu:22.04:LTS mozjs91 0 No fix
Ubuntu:Pro:18.04:LTS mozjs38 0 No fix
Ubuntu:Pro:18.04:LTS mozjs52 0 No fix
Ubuntu:Pro:20.04:LTS mozjs52 0 No fix
Ubuntu:Pro:20.04:LTS mozjs68 0 No fix
Ubuntu:Pro:22.04:LTS mozjs78 0 No fix
openSUSE:Tumbleweed MozillaFirefox 0 110.0.1-1.1
openSUSE:Tumbleweed firefox-esr 0 128.5.1-1.1

Related vulnerabilities