Skip to content

Arbitrary code execution due to improper sanitization of web app properties on Linux and PortableApps.com

Critical
filips123 published GHSA-jmhv-m7v5-g5jq May 2, 2024

Package

PWAsForFirefox (Linux)

Affected versions

< 2.12.0

Patched versions

2.12.0
PWAsForFirefox (PortableApps.com)
< 2.12.0
2.12.0

Description

Impact

Due to improper sanitization of web app properties (such as name, description, shortcuts), web apps were able to inject additional lines into XDG Desktop Entries (on Linux) and AppInfo.ini (on PortableApps.com). This allowed malicious web apps to introduce keys like Exec, which could run arbitrary code when the affected web app was launched.

This vulnerability affects all Linux and PortableApps.com users of all PWAsForFirefox versions up to (excluding) 2.12.0. Windows and macOS users are probably not affected.

Patches

The vulnerability has been fixed in 9932d4b, released in v2.12.0.

The main fix is implemented in the native part, but the extension also contains additional fixes.

All Linux and PortableApps.com users are advised to update to this version as soon as possible. It is also recommended for Windows and macOS users to update to this version, as it contains additional fixes related to properties sanitization.

References

Severity

Critical

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CVE ID

CVE-2024-32986

Weaknesses