CVE-2023-29547

What it actually does

The vulnerability permits creation of an insecure cookie for a domain that already holds a secure cookie in the browser jar, bypassing the expected silent failure and resulting in desynchronization where reads from the secure cookie produce inconsistent or unexpected results.

Why it matters to the business

Users on outdated browser versions may experience disrupted session handling or authentication flows on sites relying on secure cookies, increasing risk of unauthorized access or data exposure without requiring direct compromise of servers.

How an attack unfolds

An attacker hosts a malicious site that attempts to set an insecure cookie for a target domain known to use secure cookies; when a user on an affected Firefox version visits the site, the insecure cookie is accepted instead of failing, desynchronizing cookie state and allowing the attacker to exploit resulting inconsistencies in cookie-based logic.

How to fix it

Upgrade all instances of Mozilla Firefox, Firefox ESR, and Focus for Android to version 112 or later to enforce proper secure cookie handling.

How to confirm the fix worked

Confirm browser version is 112 or higher; test by attempting to set an insecure cookie for a domain with an existing secure cookie and verify the operation silently fails as expected.

Typical attack path

1. Identify target domain using secure cookies for authentication or sessions
2. Host attacker-controlled site that issues Set-Cookie for insecure variant of the same domain
3. Lure user on vulnerable Firefox version to visit the site via phishing or watering hole
4. Insecure cookie is stored, desynchronizing expected secure cookie behavior
5. Leverage resulting cookie state mismatch to bypass authorization checks

How to detect it

Review browser cookie storage and network logs for unexpected insecure cookie entries on domains that should only use secure variants; correlate with user navigation to untrusted sites around the time of suspected issues.

What your security team should do

• Prioritize immediate upgrade of all Firefox-based browsers to 112+ across the environment
• Review web applications for reliance on secure cookie flags and implement server-side cookie validation as defense-in-depth
• Monitor vulnerability disclosure feeds for any new exploitation reports given the authorization bypass nature