Cross-site tracing in Mozilla products - CVE-2022-45411

Detailed vulnerability description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to an error when handling non-standard headers. Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to JavaScript (such as cookies protected by HTTPOnly). To mitigate this attack, browsers placed limits on fetch() and XMLHttpRequest; however some webservers have implemented non-standard headers such as X-Http-Method-Override that override the HTTP method, and made this attack possible again.

How to mitigate CVE-2022-45411

Sources

• https://www.mozilla.org/en-US/security/advisories/mfsa2022-47/
• https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/