CVE-2022-22637

What it actually does

Logic flaw in state management permits a malicious website to trigger unauthorized cross-origin behavior, bypassing intended authorization boundaries.

Why it matters to the business

Attackers can access or manipulate data across security boundaries, risking data exposure, session hijacking, and compliance violations; urgency is elevated by ecosystem prevalence and noted threat actor interest despite low EPSS.

How an attack unfolds

An attacker crafts a malicious website that leverages the flawed state management to induce unexpected cross-origin actions; named actors including Interlock ransomware campaign have been associated with similar web-based bypass techniques.

How to fix it

Upgrade affected curl/curl (GIT) installations to commit 7161cb17c01dcff1dc5bf89a18437d9d729f1ecd or later; apply equivalent patches in downstream products and verify state management hardening.

How to confirm the fix worked

Confirm deployment of the listed fixed commit or patched releases; review cross-origin handling test cases and state transition logic for proper enforcement.

Typical attack path

1. Victim visits attacker-controlled malicious website
2. Site triggers the state management logic issue
3. Unexpected cross-origin request or data flow occurs
4. Attacker obtains unauthorized access or performs actions on behalf of the victim

How to detect it

Review web proxy, browser, and application logs for anomalous cross-origin requests originating from untrusted domains; correlate with threat actor patterns associated with web authorization bypass campaigns.

What your security team should do

• Prioritize upgrade of curl/curl (GIT) to the referenced fixed commit within 48 hours given threat actor mentions
• Scan for any downstream dependents and apply equivalent updates
• Monitor EPSS trend for continued increase and reassess exposure