PT-2024-25034 · Unknown · Pwasforfirefox

Filips123 · Published 2024-05-03 · Updated 2024-05-03 · CVE-2024-32986

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PWAsForFirefox versions prior to 2.12.0

Description The issue arises from improper sanitization of web app properties, such as name, description, and shortcuts, allowing malicious web apps to inject additional lines into XDG Desktop Entries on Linux and AppInfo.ini on PortableApps.com. This enables malicious web apps to introduce keys like Exec, which can run arbitrary code when the affected web app is launched. The vulnerability affects Linux and PortableApps.com users. There are no known workarounds for this issue.

Recommendations For PWAsForFirefox versions prior to 2.12.0, update to version 2.12.0 as soon as possible to fix the vulnerability. It is also recommended for Windows and macOS users to update to this version, as it contains additional fixes related to properties sanitization.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

CWE-150

CWE-93

Related Identifiers

CVE-2024-32986

GHSA-JMHV-M7V5-G5JQ

Affected Products

Pwasforfirefox

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32986.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-32986 · Security Note
• https://osv.dev/vulnerability/CVE-2024-32986 · Vendor Advisory
• https://github.com/filips123/PWAsForFirefox/security/advisories/GHSA-jmhv-m7v5-g5jq · Note
• https://github.com/filips123/PWAsForFirefox/releases/tag/v2.12.0 · Note
• https://github.com/filips123/PWAsForFirefox/commit/9932d4b289631d447f88ace09a2fabafe4cd5bd5 · Note
• https://twitter.com/CVEnew/status/1786408495153082541 · Twitter Post
• https://t.me/cvenotify/79018 · Telegram Post