Cloudanix VulnDB

CVE-2022-45417

Medium · 4.3

CVSS

4.3

EPSS

0.4%

Published

Dec 22, 2022

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A privacy feature in the browser could accidentally leave traces of private web sessions on the computer, revealing activity that should have stayed hidden.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Data Exposure
Component
Application
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Service Workers were not correctly identified as running in Private Browsing Mode, allowing them to be persisted to disk and thereby leaking metadata about Private Browsing sessions.

Why it matters to the business

Organizations relying on private browsing for sensitive workflows face increased risk of local data leakage that could be recovered from disk images or forensic analysis, potentially violating privacy expectations or regulatory requirements.

How an attack unfolds

An attacker with access to a user's local storage after a private browsing session can locate residual Service Worker scripts or caches on disk that were not supposed to be written, revealing that the user visited specific sites while attempting to remain private.

How to fix it

Upgrade nextcloud/spreed to commit 8bb0142338c2c12f23e3e06e704511cf233456e8 or later; for Firefox users ensure version 107 or newer is deployed across the environment.

How to confirm the fix worked

Confirm the installed nextcloud/spreed revision matches or exceeds 8bb0142338c2c12f23e3e06e704511cf233456e8 and verify that Private Browsing Mode no longer produces persistent Service Worker artifacts in the profile directory.

Typical attack path

  1. User visits a site while in Private Browsing Mode
  2. Service Worker registration is not suppressed
  3. Service Worker files and associated data are written to the local profile directory
  4. Attacker later obtains the disk image or profile folder and inspects for the unexpected artifacts

How to detect it

Examine endpoint file-system artifacts and browser profile directories for Service Worker registrations or cache directories created during private sessions; cross-reference with browser history or process logs indicating private mode usage around the same timestamps.

What your security team should do

  • Prioritize upgrade of nextcloud/spreed instances to the listed fixed commit within standard change windows
  • Audit disk images or endpoint backups for any historical Service Worker artifacts from private sessions
  • Review browser and web-application update policies to ensure rapid adoption of privacy-related fixes

The record

Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers being written to disk for websites visited in Private Browsing Mode. This would not have persisted them in a state where they would run again, but it would have leaked Private Browsing Mode details to disk. This vulnerability affects Firefox < 107.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:18.04:LTS firefox 0 107.0+build2-0ubuntu0.18.04.1
Ubuntu:18.04:LTS mozjs38 0 No fix
Ubuntu:18.04:LTS mozjs52 0 No fix
Ubuntu:20.04:LTS firefox 0 107.0+build2-0ubuntu0.20.04.1
Ubuntu:20.04:LTS mozjs52 0 No fix
Ubuntu:20.04:LTS mozjs68 0 No fix
Ubuntu:22.04:LTS mozjs78 0 No fix
Ubuntu:22.04:LTS mozjs91 0 No fix
Ubuntu:Pro:18.04:LTS mozjs38 0 No fix
Ubuntu:Pro:18.04:LTS mozjs52 0 No fix
Ubuntu:Pro:20.04:LTS mozjs52 0 No fix
Ubuntu:Pro:20.04:LTS mozjs68 0 No fix
Ubuntu:Pro:22.04:LTS mozjs78 0 No fix
openSUSE:Tumbleweed MozillaFirefox 0 107.0-1.1
openSUSE:Tumbleweed firefox-esr 0 128.5.1-1.1

Related vulnerabilities