Bug: Potential for Insecure Installations of Firefox on Windows
Status: RESOLVED
Priority: --
Resolution: DUPLICATE
Created: 2022-02-25 23:21:57+00:00
Resolved: 2023-05-23 03:28:44+00:00

Steps to reproduce:

1.	Using a fresh, fully patched Windows 10 or 11 system, download the Mozilla Firefox (enterprise) application installer, not MSI ( https://www.mozilla.org/en-CA/firefox/enterprise/).
2.	Run the Firefox installer. When prompted, select the destination folder to be “C:\Mozilla Firefox”, instead of the default “C:\Program Files\Mozilla Firefox”. Continue with the installation until it is complete.
3.	Check the security permissions on the “C:\Mozilla Firefox\firefox.exe” binary and note that the low-permission “Authenticated Users” group inherited access to modify the executable from “C:\”.
4.	Because Mozilla Firefox now exists as an installed program that could be shared by multiple users, the installation is insecure and could facilitate cross-user attacks.



Actual results:

The latest available enterprise application (not MSI) installer for the Mozilla Firefox allows users to specify the installation directory during setup but fails to set secure file system permissions on folders or files that are written to that directory, which can result in insecure installations of Mozilla Firefox that can be exploited to modify the application files and perform attacks against other users of the system.
 
If a user decides to install the application somewhere like “C:\” (%SystemDrive%), the Mozilla Firefox folders and files will inherit a set of insecure permissions that would allow any member of the Windows “Authenticated Users” local group to modify files and subfolders in the Mozilla Firefox installation, which would result in an insecure installation. 
The “weak” permissions on folders like “C:\” (and the root of every other local storage drive) are a Windows design decision; it’s just the way the operating system is, so we need to build things with that in mind. 
The weak permissions Mozilla Firefox inherits from the user-specified installation folder could be abused by other users of the system to modify the installation to perform attacks against other users of the system (“cross-user attacks”), which could result in privilege escalations. Consider the example below:
1.	Bill and his son Calvin share a computer.
2.	Bill, an administrator-level user on the computer, installs the Mozilla Firefox application somewhere with weak file system permissions “C:\” or “C:\Applications”, and proceeds to use the application on a regular basis.
3.	Calvin, a non-administrative user, replaces the “ts3client_win64.exe” binary with a malicious executable, perhaps a program that changes the desktop background, or a banking trojan.
4.	Bill opens the Mozilla Firefox application, like he always does, and inadvertently runs Calvin’s malicious binary, which allows Calvin’s code to execute as Bill, with all his privileges. 

The cross-user attack example above is not an example of social engineering: Bill was in no way coerced into running an application he wouldn’t normally run, rather, he ran an application he routinely runs with no prompting. Because Bill was an administrator, this cross-user attack would have resulted in a privilege escalation. Cross-user attacks, regardless of whether privilege escalation is achieved, would be damaging in any environment where users share systems. Shared environments are commonly found in:
•	Academic institutions
•	Libraries
•	Internet Cafes
•	Enterprises
•	Households with fewer computers than people

In short, users expect application installers to produce secure installations, regardless of the options chosen during that installation. 



Expected results:

In short, users expect application installers to produce secure installations, regardless of the options chosen during that installation. 

I see a couple remediation options:
1.	Stop supporting the option for custom installation directories. The default %ProgramFiles% location was secure, so dropping support for custom installation directories would guarantee secure installations every time.
2.	Configure the installer to set explicit permissions on the installation directory. If you wanted to make this a system-wide installation (“install for all users”), then I would suggest cloning the permissions from the %ProgramFiles% directory and applying them to the “Mozilla Firefox” folder, as proposed in the following 2008 MSDN article about Windows file system permissions: https://docs.microsoft.com/en-us/archive/msdn-magazine/2008/november/access-control-understanding-windows-file-and-registry-permissions.