CVE-2023-25734: 
NixOS vulnerability analysis and mitigation

CVE-2023-25734 is a security vulnerability affecting Firefox, Firefox ESR, and Thunderbird on Windows systems. The vulnerability was discovered by Ameen Basha M K and Shaheen Fazim and disclosed in February 2023. The issue affects Firefox versions < 110, Firefox ESR < 102.8, and Thunderbird < 102.8. The vulnerability allows attackers to exploit Windows .url shortcut files to cause unexpected network requests and potentially leak NTLM credentials (Mozilla Advisory).

The vulnerability occurs when downloading a Windows .url shortcut from the local filesystem. An attacker could supply a remote path in the shortcut file that would trigger unexpected network requests from the operating system. The vulnerability is particularly concerning because it can be exploited through the IconFile parameter in .url files to leak NTLM credentials without user interaction. The issue has been assigned a CVSS v3.1 base score of 8.1 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N (NVD).

The primary impact of this vulnerability is the potential for credential theft and unauthorized network requests. When exploited, the vulnerability can lead to the disclosure of NTLM password hashes to remote attackers, which could be used for further attacks. The vulnerability affects only Windows systems, with other operating systems being unaffected (Mozilla Advisory, Bugzilla).

Mozilla has addressed this vulnerability by implementing security measures to prevent the direct downloading of .url files. The fix was released in Firefox 110, Firefox ESR 102.8, and Thunderbird 102.8. The solution involves adding .url to the same blocklist as .lnk and .local files, causing these files to be downloaded with a .download extension to prevent automatic execution (Mozilla Advisory).

The vulnerability received attention from security researchers and the Mozilla security team, leading to multiple independent reports of the issue. The severity was initially classified as moderate, but further analysis revealed more serious implications, particularly regarding the ability to leak NTLM credentials without user interaction (Bugzilla).