CVE-2022-45411

What it actually does

The flaw permits cross-site tracing by allowing non-standard headers such as X-Http-Method-Override to bypass browser restrictions on the TRACE method, enabling XSS to read HTTPOnly cookies and authorization headers.

Why it matters to the business

Attackers can steal session credentials and authentication tokens, resulting in account compromise and unauthorized access to sensitive user data across affected browser deployments.

How an attack unfolds

An attacker hosts a malicious page that issues requests using override headers to trigger TRACE responses; the echoed headers containing cookies are then accessible to the attacker's script, bypassing prior mitigations in vulnerable Firefox and Thunderbird versions.

How to fix it

Upgrade affected products to the fixed versions listed: tensorflow/tensorflow (GIT) fixed in aed36912609fc07229b4d0a7b44f3f48efc00fd0. Apply browser updates to versions beyond the vulnerable ranges described.

How to confirm the fix worked

Verify deployed browser versions are at or above the fixed releases; inspect server configurations to disable or restrict TRACE method and non-standard override headers.

Typical attack path

1. Host malicious webpage containing script using X-Http-Method-Override header
2. Lure victim to visit page while authenticated in vulnerable browser
3. Script sends crafted request that server echoes back via TRACE
4. Extract and exfiltrate authorization headers and HTTPOnly cookies

How to detect it

Search web server logs for TRACE method usage combined with X-Http-Method-Override headers; inspect browser process versions and any anomalous cross-origin requests carrying authentication data.

What your security team should do

• Prioritize patching all instances of affected browsers to the latest fixed releases
• Review and harden web server configurations to reject TRACE and method override headers
• Monitor EPSS trend for any increase in exploit probability