CVE-2023-29541

What it actually does

Improper input validation allows .desktop files downloaded via the browser to be interpreted as executable launchers containing attacker-controlled commands on certain Linux distributions.

Why it matters to the business

Successful exploitation can lead to arbitrary command execution on user workstations, resulting in data compromise, malware deployment, or lateral movement within Linux desktop environments.

How an attack unfolds

An attacker prepares a malicious .desktop file embedding shell commands and hosts it for download. A victim using a vulnerable browser on an affected Linux distribution downloads the file; the browser's failure to sanitize the file type permits the desktop environment to treat it as an executable, running the embedded commands under the user's context.

How to fix it

Upgrade Firefox to version 112 or later, Firefox ESR to 102.10 or later, Focus for Android to 112 or later, Firefox for Android to 112 or later, and Thunderbird to 102.10 or later. Block or sanitize .desktop file downloads where possible and restrict execution of downloaded launchers.

How to confirm the fix worked

Verify installed browser versions meet or exceed the fixed releases listed above; attempt controlled download of a benign .desktop file and confirm it is not treated as executable.

Typical attack path

1. Craft malicious .desktop file containing arbitrary commands
2. Host file on attacker-controlled web server
3. Lure user to download via social engineering or compromised site
4. Browser accepts and stores file without proper type handling
5. Desktop environment executes file upon interaction, running commands

How to detect it

Review browser download logs and file system events for .desktop files originating from the browser; inspect process execution chains starting from download directories or file open handlers; correlate with user activity around unexpected command execution.

• execution of files ending in .desktop from browser download paths
• xdg-desktop or desktop-file-execute processes launched from ~/Downloads
• unexpected shell commands in .desktop Exec= entries within user download folders

What your security team should do

• Prioritize immediate browser updates across all Linux endpoints
• Implement download restrictions or sandboxing for file types that can execute commands
• Update endpoint detection rules to flag execution of downloaded .desktop files