documentation_complete: true

title: 'Disable Firefox Access to Shell Protocols'

description: |-
    Access to the shell is disabled by default but can be changed.
    To prevent shell access from being enabled, set
    <tt>network.protocol-handler.external.shell</tt> to <tt>false</tt>.

rationale: |-
    If enabled, this setting would allow the browser to access the Windows shell.
    This could allow access to the underlying system.

severity: medium

identifiers:
    cce: ""

references:
    disa: ""
    nist: ECSC-1
    stigid: DTBF105

ocil_clause: 'it is not disabled'

ocil: |-
    To verify that the shell protocol access is disabled,
    run the following command:
    <pre>$ grep 'network.protocol-handler.external.shell' <i>FIREFOX_INSTALL_DIR</i>/*.cfg</pre>
    The output should return:
    <pre>lockPref("network.protocol-handler.external.shell", "false");</pre>
