CVE-2022-22757: 
NixOS vulnerability analysis and mitigation

Remote Agent, a component used in Firefox's WebDriver functionality, contained a security vulnerability (CVE-2022-22757) where it failed to validate Host or Origin headers. This vulnerability was discovered by James Graham and affected Firefox versions prior to 97. The issue was fixed and disclosed in February 2022 (Mozilla Advisory).

The vulnerability stemmed from the Remote Agent's failure to properly validate Host and Origin headers in WebSocket connections. This security flaw was present in the WebSocket handshake implementation. The vulnerability received a CVSS v3.1 Base Score of 6.5 (Medium) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (NVD).

The vulnerability could allow malicious websites to establish a connection back to the user's browser and potentially control it through the WebDriver interface. However, the impact was limited as this vulnerability only affected Firefox installations where WebDriver was enabled, which is not the default configuration (Mozilla Advisory).

The vulnerability was addressed in Firefox version 97. Users were advised to update their Firefox installations to this version or later. The fix involved implementing proper validation of Host and Origin headers in the WebSocket handshake process (Ubuntu Notice).