CVE-2022-40956

What it actually does

The vulnerability permits an attacker-injected HTML base element to override the base-uri directive in a page's Content-Security-Policy, causing subsequent requests to resolve against the attacker's supplied base URL instead of the policy-defined origin.

Why it matters to the business

Organizations relying on CSP to protect web applications delivered to users of the affected browsers face elevated risk of cross-site scripting and data leakage, potentially resulting in compromised user sessions or unauthorized actions within those applications.

How an attack unfolds

An attacker first delivers HTML content containing a malicious base element to a victim (via stored or reflected injection), after which the browser ignores the CSP base-uri restriction and resolves subresource or navigation URLs against the attacker's domain, enabling loading of attacker-controlled scripts or exfiltration endpoints.

How to fix it

Upgrade Mozilla Firefox to version 105 or later, Firefox ESR to 102.3 or later, and Thunderbird to 102.3 or later; enforce strict CSP base-uri directives in all web applications and consider additional client-side protections such as Subresource Integrity where feasible.

How to confirm the fix worked

Verify deployed browser versions meet or exceed the fixed releases; test affected pages with injected base elements while monitoring that CSP base-uri continues to block unauthorized base resolutions.

Typical attack path

1. Deliver HTML containing an injected base element to a victim browser
2. Trigger page load or navigation that respects the injected base
3. Bypass CSP base-uri enforcement for subsequent requests
4. Load malicious scripts or exfiltrate data from attacker-controlled origin

How to detect it

Review web server or proxy logs for unexpected base URL origins in requests originating from affected browser user-agents; inspect client-side CSP violation reports for base-uri bypass patterns; correlate with browser version telemetry to identify exposure windows.

What your security team should do

• Prioritize browser updates across all managed endpoints given the widespread use of affected Mozilla products
• Audit web applications for CSP implementations that rely on base-uri and strengthen them with additional directives
• Monitor EPSS and exploit maturity indicators for any future increase in weaponization