CVE-2025-5265: Mozilla Firefox RCE Vulnerability

CVE-2025-5265 Overview

CVE-2025-5265 is a command injection vulnerability affecting Mozilla Firefox for Windows. Due to insufficient escaping of the ampersand character in the "Copy as cURL" feature, an attacker could trick a user into using a maliciously crafted command, potentially leading to local code execution on the user's system.

This vulnerability is classified as CWE-77 (Command Injection), where improper neutralization of special characters allows attackers to inject arbitrary commands into a command string. The "Copy as cURL" developer tool feature is commonly used by web developers to replicate HTTP requests from the browser's network panel, making this an attractive target for social engineering attacks against technical users.

Critical Impact

Attackers can achieve local code execution on Windows systems by convincing users to copy and execute a malicious cURL command generated by the browser's developer tools.

Affected Products

• Mozilla Firefox < 139
• Mozilla Firefox ESR < 115.24
• Mozilla Firefox ESR < 128.11
• Thunderbird < 139
• Thunderbird < 128.11

Note: This vulnerability only affects Firefox for Windows. Other operating system versions of Firefox are unaffected.

Discovery Timeline

• May 27, 2025 - CVE-2025-5265 published to NVD
• June 11, 2025 - Last updated in NVD database

Technical Details for CVE-2025-5265

Vulnerability Analysis

The vulnerability exists in Firefox's "Copy as cURL" functionality, a developer tool feature that generates cURL commands from network requests captured in the browser's Network panel. When a user right-clicks on a network request and selects "Copy as cURL," Firefox generates a command-line string that can be pasted into a terminal to replicate the request.

The root cause is the insufficient escaping of the ampersand (&) character in the generated cURL command. On Windows command shells (cmd.exe and PowerShell), the ampersand serves as a command separator, allowing multiple commands to be executed in sequence. When this character appears in URL parameters or request data and is not properly escaped, an attacker can craft a malicious request that, when converted to a cURL command and executed, runs additional arbitrary commands.

Root Cause

The vulnerability stems from improper input validation and output encoding in the cURL command generation code. Firefox's implementation failed to account for Windows-specific shell metacharacters when escaping the generated command string. While certain special characters were properly escaped for Unix-like shells, the Windows-specific handling of the ampersand character was insufficient.

This is a classic case of CWE-77 (Command Injection), where user-controlled input that flows into a command execution context is not properly sanitized.

Attack Vector

The attack requires social engineering to succeed. An attacker would need to:

1. Create a web page with network requests containing malicious ampersand-injected payloads in URL parameters or request bodies
2. Convince a target user to visit the malicious page and open the browser's developer tools
3. Trick the user into using the "Copy as cURL" feature on the malicious request
4. Have the user paste and execute the generated command in a Windows terminal

When the user pastes the seemingly legitimate cURL command into their terminal, the unescaped ampersand causes the shell to interpret portions of the string as separate commands, leading to arbitrary code execution with the user's privileges.

The attack leverages the trust users place in browser-generated commands and targets developers and technical users who frequently use the "Copy as cURL" feature for debugging and API testing purposes.

Detection Methods for CVE-2025-5265

Indicators of Compromise

• Suspicious cURL commands in shell history containing unexpected ampersand characters followed by additional commands
• Unexpected process execution originating from cmd.exe or PowerShell following cURL command usage
• Network requests to suspicious domains containing encoded or obfuscated command sequences in URL parameters
• Unusual child processes spawned from terminal applications after pasting browser-generated commands

Detection Strategies

• Monitor for process chains where cmd.exe or PowerShell spawns unexpected child processes after cURL execution
• Implement endpoint detection rules for command strings containing patterns like curl followed by & and system command keywords (powershell, cmd, whoami, etc.)
• Review browser history and network logs for requests with suspicious URL parameter patterns
• Deploy SentinelOne's behavioral AI to detect anomalous command execution patterns from terminal applications

Monitoring Recommendations

• Enable command-line logging on Windows endpoints to capture full command strings executed in terminals
• Configure SentinelOne policies to alert on suspicious command injection patterns in shell processes
• Implement network monitoring for web pages serving requests with unusual parameter encoding
• Establish baselines for normal developer tool usage to identify anomalous activity

How to Mitigate CVE-2025-5265

Immediate Actions Required

• Update Mozilla Firefox to version 139 or later immediately
• Update Mozilla Firefox ESR to version 115.24 or 128.11 or later
• Update Thunderbird to version 139 or 128.11 or later
• Educate development teams about the risks of executing copied commands without verification
• Review and audit any recently executed cURL commands on Windows systems

Patch Information

Mozilla has released patches addressing this vulnerability across multiple product versions. Security updates are available through the following advisories:

• Mozilla Security Advisory MFSA-2025-42
• Mozilla Security Advisory MFSA-2025-43
• Mozilla Security Advisory MFSA-2025-44
• Mozilla Security Advisory MFSA-2025-45
• Mozilla Security Advisory MFSA-2025-46

For technical details about the underlying issue, see Mozilla Bug Report #1962301.

Workarounds

• Avoid using the "Copy as cURL" feature on untrusted websites until patches are applied
• Manually inspect all copied cURL commands before execution, looking for unexpected ampersand characters and additional commands
• Use alternative tools to capture and replay HTTP requests instead of the browser's built-in feature
• Consider using Linux/macOS systems for cURL command generation as they are not affected by this specific vulnerability
• Implement application allowlisting to prevent execution of unexpected commands from terminal sessions

# Verify Firefox version on Windows
# Open Firefox and navigate to about:support
# Or check via command line:
"C:\Program Files\Mozilla Firefox\firefox.exe" --version | findstr /r "[0-9]*\.[0-9]*"

# Ensure version is 139 or higher (standard release)
# Or 115.24+ / 128.11+ for ESR versions