CVE-2022-40958

What it actually does

Injection of a cookie containing special characters from a shared non-secure subdomain allows overwriting of cookies set in a secure context, enabling session fixation and related cookie manipulation attacks.

Why it matters to the business

Attackers may hijack user sessions in browser-based applications, resulting in unauthorized access, account compromise, and potential data exposure for organizations relying on affected Mozilla products.

How an attack unfolds

An attacker positioned on a shared subdomain crafts and injects a malicious cookie using special characters to overwrite legitimate secure cookies, achieving session fixation without needing direct access to the target domain.

How to fix it

Upgrade Mozilla Firefox to version 105 or later, Firefox ESR to 102.3 or later, and Thunderbird to 102.3 or later. Apply updates across all affected installations as soon as possible.

How to confirm the fix worked

Verify installed browser and mail client versions against the fixed releases; confirm that cookie-setting behavior from non-secure subdomains no longer affects secure-context cookies through targeted testing.

Typical attack path

1. Identify a shared subdomain that is not a secure context
2. Craft a cookie payload containing special characters designed to overwrite target cookies
3. Deliver the cookie injection to a victim browser visiting the subdomain
4. Use the fixed session identifier to impersonate the victim in the secure context

How to detect it

Examine web server or proxy logs for anomalous cookie-setting requests originating from non-secure subdomains; review browser forensic artifacts for unexpected cookie values after visits to shared domains.

What your security team should do

• Immediately deploy the fixed versions to all endpoints
• Review and enforce secure cookie attributes (Secure, HttpOnly, SameSite) in web applications
• Monitor vulnerability disclosure feeds for any change in exploit maturity or KEV listing