Introduction
Microsoft Edge users face a critical threat from CVE-2025-49741, an information disclosure vulnerability actively targeted by malicious actors. Exploiting middleware logic flaws, attackers can silently exfiltrate sensitive data, posing a significant risk to enterprise and individual users alike.
Technical Information
The vulnerability specifically involves the improper validation of the x-middleware-subrequest HTTP header within Microsoft Edge. Attackers exploit this by crafting malicious requests with the following header:
x-middleware-subrequest: middleware
This header manipulation bypasses middleware logic, circumventing authorization checks and granting unauthorized access to sensitive resources. Attack vectors include:
- Header Manipulation: Injecting malicious headers to bypass middleware.
- Drive-by Exploits: Malicious websites initiating automatic requests to exploit the vulnerability without user interaction.
- Chained Exploits: Combining this vulnerability with social engineering to escalate access.
The root cause lies in Edge's failure to adequately validate middleware headers, allowing attackers to bypass security mechanisms and access cached user data and session tokens.
Patch Information
Microsoft has released a security update to address CVE-2025-49741, affecting Windows Remote Desktop Services (RDS). The patch modifies RDS handling of connection requests, ensuring maliciously crafted requests are properly validated, preventing unintended code execution.
Users should configure systems for automatic updates or manually download the update from the Microsoft Update Catalog. Prompt application of this patch is crucial.
Affected Systems and Versions
- Microsoft Edge (Chromium-based) versions prior to 137.0.3296.62
Vendor Security History
Microsoft has previously addressed similar vulnerabilities promptly, such as CVE-2025-5419, demonstrating a robust and responsive security posture. Their regular security updates and transparent disclosure practices underscore their commitment to security.
References
Source: This report was created using AI
If you have suggestions for improvement or feedback, please reach out to us at [email protected]