CVE-2023-29545

What it actually does

On Windows builds, the Save Link As dialog resolved environment variable tokens present in attacker-supplied filename suggestions, expanding them in the context of the current user and allowing the resulting path to be used for the saved file.

Why it matters to the business

An attacker can cause a user who saves a crafted link to write a file to an unintended location on the local system, potentially overwriting configuration or executable files and leading to application instability or follow-on compromise.

How an attack unfolds

An attacker hosts a page or sends a message containing a hyperlink whose download filename suggestion embeds Windows environment variable tokens. When the victim selects Save Link As, the browser expands the tokens, producing a path that points outside the intended download directory; the file is then written to that location.

How to fix it

Upgrade Firefox to 112 or later, Firefox ESR to 102.10 or later, and Thunderbird to 102.10 or later. On Windows systems where immediate upgrade is not possible, disable the Save Link As feature or restrict user ability to save downloads from untrusted sources.

How to confirm the fix worked

Confirm the installed browser or mail client reports a version at or above the fixed releases; re-test Save Link As behavior with a filename containing %TEMP% or %APPDATA% to verify expansion no longer occurs.

Typical attack path

1. Craft a hyperlink with a filename containing expandable environment variable tokens
2. Deliver the link via web page, email, or messaging
3. Victim triggers Save Link As on the link
4. Browser expands the tokens and writes the file to the resulting path
5. Attacker later leverages the written file for further access or persistence

How to detect it

Review browser download logs and Windows file-creation events around the time of suspected link clicks for files written to unexpected directories; correlate with web proxy or email logs showing links that were later saved.

What your security team should do

• Prioritize patching all Windows Firefox, ESR, and Thunderbird instances to the fixed versions
• Enable automatic updates for Mozilla products across the fleet
• Add browser version checks to endpoint compliance scans
• Review recent download activity logs for unexpected file placements