CVE-2023-23598: Arbitrary file read from GTK drag and drop on Linux
Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to DataTransfer.setData.
External Reference: https://www.mozilla.org/en-US/security/advisories/mfsa2023-02/#CVE-2023-23598
Other sources
Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to DataTransfer.setData. This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7.
— MITRE
Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to <code>DataTransfer.setData</code>. This vulnerability affects Firefox < 109, Thunderbird < 102.7, and Firefox ESR < 102.7.
Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to DataTransfer.setData.
Due to the Thunderbird GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to DataTransfer.setData.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 102.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 109 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 102.7 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 102.7.0-r0 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0.1-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1 - Upgrade
Upgrade
redhat/firefoxto a version that resolves this vulnerability.Fixed in 102.7 - Upgrade
Upgrade
redhat/thunderbirdto a version that resolves this vulnerability.Fixed in 102.7
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is vulnerability CVE-2023-23598?
Vulnerability CVE-2023-23598 is a security flaw in the Firefox GTK wrapper code that allows a website to read arbitrary files.
Which software versions are affected by CVE-2023-23598?
This vulnerability affects Firefox versions earlier than 109 and Thunderbird versions earlier than 102.7.
How can a website exploit CVE-2023-23598?
A website can exploit CVE-2023-23598 by using a call to DataTransfer.setData to read files.
How severe is vulnerability CVE-2023-23598?
Vulnerability CVE-2023-23598 is considered high severity with a CVSS score of 6.5.
Are there any references for more information about CVE-2023-23598?
Yes, you can find more information about CVE-2023-23598 at the following references: [Link 1](https://www.mozilla.org/security/advisories/mfsa2023-01/), [Link 2](https://www.mozilla.org/security/advisories/mfsa2023-03/), [Link 3](https://www.mozilla.org/security/advisories/mfsa2023-02/).