CVE-2020-6828: 
Mozilla Firefox ESR vulnerability analysis and mitigation

CVE-2020-6828 is a high-severity vulnerability discovered in Firefox for Android that was disclosed and patched in April 2020. The vulnerability allows a malicious Android application to craft an Intent that could be processed by Firefox for Android, potentially resulting in a file overwrite in the user's profile directory (Mozilla Advisory).

The vulnerability exists in Firefox for Android's handling of content URIs through the ContentUriUtils.getTempFilePathFromContentUri method. When a crafted Intent containing a URI pointing to a custom-defined ContentProvider is sent, the application queries the ContentProvider to fetch files, allowing an attacker to overwrite files under the private application folder. The vulnerability was fixed in Firefox ESR 68.7 by implementing proper sanitization of content URI filenames (Mozilla Advisory, Bugzilla).

The vulnerability allows attackers to overwrite files in the user's profile directory, specifically targeting files like profiles.ini and user.js. By manipulating these files with malicious preference values, an attacker could achieve network hijacking capabilities. The level of control over arbitrary preferences makes this vulnerability equivalent to arbitrary code execution in terms of impact (Mozilla Advisory).

The vulnerability requires a malicious Android application to craft a specific Intent that exploits the file handling mechanism in Firefox for Android. The exploitation effort is considered medium, and proof-of-concept code was demonstrated to Mozilla during the vulnerability disclosure (Decipher).

The vulnerability was patched in Firefox ESR 68.7. Users should update to this version or later to protect against this vulnerability. The fix involves sanitizing content URI filenames by using only the leaf filename instead of allowing path traversal (Mozilla Advisory).