SV-223158r612236: Firefox is not configured to prompt a user before downloading and opening required file types. | Mozilla Firefox Security Technical Implementation Guide

Loading benchmark…

Assessment Title

Rule Text

Firefox is not configured to prompt a user before downloading and opening required file types.

Description

Discussion Text

New file types cannot be added directly to the helper applications or plugins listing. Files with these extensions will not be allowed to use Firefox publicly available plugins and extensions to open. The application will be configured to open these files using external applications only. After a helper application or save to disk download action has been set, that action will be taken automatically for those types of files. When the user receives a dialog box asking if you want to save the file or open it with a specified application, this indicates that a plugin does not exist. The user has not previously selected a download action or helper application to automatically use for that type of file. When prompted, if the user checks the option to Do this automatically for files like this from now on, then an entry will appear for that type of file in the plugins listing and this file type is automatically opened in the future. This can be a security issue. New file types cannot be added directly to the Application plugin listing.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-001243SV-16711V-15772

References

DPMS Target Mozilla Firefox DISA DPMS Target Mozilla Firefox 4097

Checks

DISA STIG (Manual Reference)

Open a browser window, type "about:config" in the address bar.
Criteria: If the “plugin.disable_full_page_plugin_for_types” value is not set to include the following external extensions and not locked, this is a finding:
PDF, FDF, XFDF, LSL, LSO, LSS, IQY, RQY, XLK, XLS, XLT, POT, PPS, PPT, DOS, DOT, WKS, BAT, PS, EPS, WCH, WCM, WB1, WB3, RTF, DOC, MDB, MDE, WBK, WB1, WCH, WCM, AD, ADP.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL definition: oval:mil.disa.stig.mozilla.firefox.rhel:def:50

# Check for single Firefox installation
if ! command -v firefox &> /dev/null || [ $(command -v firefox | wc -l) -ne 1 ]; then
    echo "FAIL"
    exit 1
fi

# Check for config JS file
firefox_config_js=$(find ~/.mozilla/firefox -name "*default*/*.js" -print 2>/dev/null | grep "user_pref")
if [ -z "$firefox_config_js" ]; then
    echo "FAIL"
    exit 1
fi

# Check config file content
if ! grep -q "^//.*pref\\(\"general\\.config\\.filename\"\\s*,\\s*\"(\\S+)\"\\s*\\);$" "$firefox_config_js"; then
    echo "FAIL"
    exit 1
fi

# Check for general.config.obscure_value setting
if ! grep -q "^\\s*pref\\(\\s*\"general\\.config\\.obscure_value\"\\s*,\\s*0\\s*\\)\\s*;" "$firefox_config_js"; then
    echo "FAIL"
    exit 1
fi

# Check prefs.js for plugin disabling
firefox_prefs=$(find ~/.mozilla/firefox -name "*default*/*.js" -print 2>/dev/null | grep "prefs.js")
if [ -z "$firefox_prefs" ]; then
    echo "FAIL"
    exit 1
fi

disable_types="pdf,fdf,xfdf,lsl,lso,lss,iqy,rqy,xls,xlt,pot,pps,ppt,dos,dot,wks,bat,ps,eps,wch,wcm,wb1,wb3,rtf,doc,mdb,mde,wbk,wb1,wch,wcm,ad,adp"
for type in $disable_types; do
    if ! grep -q "^\\s*pref\\(\"plugin\\.disable_full_page_plugin_for_types\"\\s*,\\s*\"($type)\"\\s*\\)\\s*;" "$firefox_prefs"; then
        echo "FAIL"
        exit 1
    fi
done

echo "PASS"
exit 0

Remediation

Ensure the following extensions are not automatically opened by Firefox without user confirmation. Do not use plugins and add-ons to open these files.
Use the "plugin.disable_full_page_plugin_for_types" preference to set and lock the following extensions so that an external application, rather than an add-on or plugin, will not be used: 
PDF, FDF, XFDF, LSL, LSO, LSS, IQY, RQY, XLK, XLS, XLT, POT, PPS, PPT, DOS, DOT, WKS, BAT, PS, EPS, WCH, WCM, WB1, WB3, RTF, DOC, MDB, MDE, WBK, WB1, WCH, WCM, AD, ADP.