CVE-2022-40958: 
NixOS vulnerability analysis and mitigation

CVE-2022-40958 is a security vulnerability discovered in Mozilla Firefox and related products that affects cookie handling mechanisms. The vulnerability was discovered by Axel Chong (@Haxatron) and disclosed in September 2022. It affects Firefox versions prior to 105.0, Firefox ESR versions before 102.3, and Thunderbird versions before 102.3 (Mozilla Advisory).

The vulnerability allows bypassing Secure Context restrictions for cookies with __Host and __Secure prefixes. By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus overwrite cookies from a secure context. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (NVD).

The vulnerability could lead to session fixation and other attacks, potentially allowing attackers to bypass security restrictions meant to protect cookie prefixes. This could enable an attacker to overwrite cookies from a secure context, compromising the security model of cookie prefixes designed to prevent such manipulations (Mozilla Advisory).

The vulnerability can be exploited by an attacker on a shared subdomain that is not a secure context. The attack involves injecting specially crafted cookies with specific characters to bypass security restrictions. The vulnerability was confirmed to be exploitable through both document.cookie manipulation and Set-Cookie headers (Mozilla Bug).

The vulnerability was fixed in Firefox 105.0, Firefox ESR 102.3, and Thunderbird 102.3. The fix involves rejecting cookies with no name and a __Secure- or __Host- prefix, preventing the bypass of secure context restrictions. Users should upgrade to these versions or newer to mitigate the vulnerability (Mozilla Advisory).