Remote code execution and exfiltration of secret tokens by poisoning the mozilla/fxa CI build cache

Summary

A security researcher was able to obtain an upload URL for NX Cloud's caching service, used by the Firefox Accounts repository. Because an authorized link could be used to upload more than once to the same artifact, the researcher was then able to poison the cache by re-uploading a modified cache artifact, and exfiltrate fxa's environment variables as a proof of concept. This vulnerability required an attacker to have access to the repository source code to be exploited, and in this case, the fxa repo is public.