CVE-2023-29541
📋 TL;DR
This vulnerability allows attackers to execute arbitrary commands on Linux systems by tricking users into downloading malicious .desktop files through Firefox. It affects Firefox, Firefox ESR, Thunderbird, and Firefox for Android on certain Linux distributions when running vulnerable versions.
💻 Affected Systems
- Firefox
- Firefox ESR
- Thunderbird
- Firefox for Android
- Focus for Android
📦 What is this software?
Firefox by Mozilla
Firefox by Mozilla
Firefox Esr by Mozilla
Focus by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining execution of arbitrary commands as the user who downloads the malicious file.
Likely Case
Limited command execution in user context, potentially leading to data theft, malware installation, or lateral movement.
If Mitigated
No impact if systems are patched or if proper download handling controls prevent .desktop file execution.
🎯 Exploit Status
Exploitation requires user interaction to download malicious file but no authentication. No public exploit code identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 112, Firefox ESR 102.10, Thunderbird 102.10, Firefox for Android 112, Focus for Android 112
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2023-13/
Restart Required: Yes
Instructions:
1. Update Firefox to version 112 or later. 2. Update Firefox ESR to version 102.10 or later. 3. Update Thunderbird to version 102.10 or later. 4. Update Firefox for Android to version 112 or later. 5. Update Focus for Android to version 112 or later.
🔧 Temporary Workarounds
Disable automatic .desktop file handling
linuxConfigure system to not automatically execute .desktop files from downloads
xdg-mime default text/plain .desktop
Use alternative browser temporarily
allSwitch to a different browser until Firefox can be updated
🧯 If You Can't Patch
- Restrict user downloads to trusted sources only
- Implement application whitelisting to prevent execution of .desktop files from download directories
🔍 How to Verify
Check if Vulnerable:
Check Firefox version: Help → About Firefox. If version is less than 112, you are vulnerable on Linux systems.Check Version:
firefox --versionVerify Fix Applied:
Confirm Firefox version is 112 or later, Firefox ESR is 102.10 or later, or Thunderbird is 102.10 or later.📡 Detection & Monitoring
Log Indicators:
- Unexpected .desktop file downloads in Firefox download logs
- Execution of commands from download directories
Network Indicators:
- Downloads of .desktop files from untrusted sources
SIEM Query:
source="firefox" AND (file_extension=".desktop" OR download_filename="*.desktop")🔗 References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1810191
- https://www.mozilla.org/security/advisories/mfsa2023-13/
- https://www.mozilla.org/security/advisories/mfsa2023-14/
- https://www.mozilla.org/security/advisories/mfsa2023-15/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1810191
- https://www.mozilla.org/security/advisories/mfsa2023-13/
- https://www.mozilla.org/security/advisories/mfsa2023-14/
- https://www.mozilla.org/security/advisories/mfsa2023-15/
