CVE-2024-32986: PWAsForFirefox RCE Vulnerability

CVE-2024-32986 Overview

CVE-2024-32986 is a critical code injection vulnerability in PWAsForFirefox, a tool designed to install, manage, and use Progressive Web Apps (PWAs) in Mozilla Firefox. Due to improper sanitization of web app properties (such as name, description, and shortcuts), malicious web apps can inject additional lines into XDG Desktop Entries on Linux systems and AppInfo.ini on PortableApps.com deployments. This injection vulnerability allows attackers to introduce keys like Exec, which can execute arbitrary code when the affected web app is launched.

Critical Impact

Remote attackers can achieve arbitrary code execution on victim systems by crafting malicious Progressive Web Apps that inject executable commands into desktop entry files, compromising system integrity when users launch the affected PWA.

Affected Products

• PWAsForFirefox versions prior to 2.12.0 on Linux systems
• PWAsForFirefox versions prior to 2.12.0 on PortableApps.com
• XDG Desktop Entry files generated by vulnerable PWAsForFirefox installations

Discovery Timeline

• 2024-05-03 - CVE-2024-32986 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-32986

Vulnerability Analysis

This vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), commonly known as Injection. The core issue stems from PWAsForFirefox's failure to properly sanitize user-controllable web app properties before writing them to system configuration files.

On Linux systems, XDG Desktop Entry files (.desktop files) define how applications are launched and displayed in desktop environments. These files use a key-value format where the Exec key specifies the command to run when the application is launched. Similarly, PortableApps.com uses AppInfo.ini files for application configuration. By injecting newlines and additional key-value pairs through unsanitized web app properties, attackers can introduce malicious Exec entries that execute arbitrary commands with the privileges of the user launching the PWA.

The attack requires user interaction—specifically, the victim must install a malicious PWA and subsequently launch it. However, given the network-accessible nature of PWAs and the social engineering potential, this represents a significant threat vector.

Root Cause

The root cause of CVE-2024-32986 lies in the insufficient input validation and output encoding of web app metadata fields. When PWAsForFirefox processes properties like the application name, description, or shortcuts from a web app manifest, it writes these values directly to configuration files without neutralizing special characters such as newlines (\n). This allows an attacker-controlled web app to break out of the intended field context and inject arbitrary configuration directives.

Attack Vector

The attack vector is network-based, requiring user interaction. An attacker can host a malicious Progressive Web App on any web server or compromise an existing legitimate PWA. When a user installs this malicious PWA through PWAsForFirefox, the crafted properties containing injection payloads are written to the desktop entry file. Upon launching the PWA, the injected Exec command executes, providing the attacker with arbitrary code execution on the victim's system.

The attack flow proceeds as follows: the attacker crafts a malicious web app manifest with specially formatted name or description fields containing newline characters followed by malicious key-value pairs. When the user installs and launches the PWA, the operating system's desktop environment parses the corrupted .desktop file and executes the attacker's payload instead of or in addition to the legitimate application.

Detection Methods for CVE-2024-32986

Indicators of Compromise

• Presence of unusual Exec entries in .desktop files under ~/.local/share/applications/ or system application directories
• XDG Desktop Entry files containing multiple Exec keys or unexpected command sequences
• AppInfo.ini files in PortableApps installations with anomalous or duplicate configuration entries
• Evidence of recently modified .desktop files correlating with PWA installation activity

Detection Strategies

• Monitor file integrity of XDG Desktop Entry files and AppInfo.ini configurations for unauthorized modifications
• Implement file content scanning rules to detect .desktop files with multiple Exec directives or suspicious command patterns
• Review PWAsForFirefox installation logs for web apps with unusual or excessively long property values
• Deploy endpoint detection rules to identify process execution chains originating from .desktop file launches with anomalous parent-child relationships

Monitoring Recommendations

• Configure file integrity monitoring (FIM) on directories containing desktop entry files (~/.local/share/applications/, /usr/share/applications/)
• Establish baseline monitoring for PWA installation events and correlate with subsequent desktop entry file changes
• Monitor process execution for commands launched via desktop files that exhibit unusual behavior patterns or connect to unexpected network destinations

How to Mitigate CVE-2024-32986

Immediate Actions Required

• Update PWAsForFirefox to version 2.12.0 or later immediately on all Linux and PortableApps.com installations
• Audit existing .desktop files in user and system application directories for signs of injection
• Review and remove any PWAs from untrusted sources that were installed prior to the update
• Windows and macOS users should also update to benefit from additional property sanitization improvements

Patch Information

The vulnerability has been fixed in commit 9932d4b which is included in PWAsForFirefox v2.12.0. The main fix is implemented in the native component of PWAsForFirefox, with the browser extension containing additional sanitization improvements. Users can verify the fix by reviewing the commit details and the GitHub Security Advisory GHSA-jmhv-m7v5-g5jq.

Workarounds

• There are no known workarounds for this vulnerability according to the vendor advisory
• Users who cannot immediately update should consider temporarily uninstalling PWAsForFirefox until the update can be applied
• Avoid installing new PWAs from untrusted sources until the patched version is deployed
• Manually inspect .desktop files before launching PWAs installed from external sources

# Verify PWAsForFirefox version and update
# Check current installed version
firefoxpwa --version

# Update PWAsForFirefox to patched version 2.12.0 or later
# For Linux users (example using package manager or manual update)
# Refer to official installation instructions for your distribution