CVE-2023-5722

What it actually does

An attacker can determine the size of an opaque cross-origin response and the exact contents of a server-supplied Vary header by issuing repeated, carefully crafted requests that measure observable side effects.

Why it matters to the business

Attackers may obtain information about server response variations and caching behavior that can be used to fingerprint applications or prepare more targeted follow-on attacks, increasing exposure for organizations that rely on Firefox or affected Linux distributions.

How an attack unfolds

An attacker repeatedly sends requests that trigger opaque responses, observes timing or size differences, and gradually reconstructs both the response length and the Vary header values without triggering CORS or direct content access.

How to fix it

Upgrade affected Firefox installations to version 119 or later. For Debian 11 systems, update to linux package version 5.10.216-1 or newer. Apply updates across all instances and verify the new version is in use.

How to confirm the fix worked

Confirm the installed Firefox or linux package version meets or exceeds the fixed release; re-test the previously vulnerable endpoint to ensure size and Vary header details are no longer leaked via iterative probing.

Typical attack path

1. Identify a target endpoint that returns an opaque response
2. Issue a series of iterative requests while varying headers or parameters
3. Measure observable differences to infer response size and Vary header contents
4. Use the leaked metadata to map server behavior or prepare further attacks

How to detect it

Review browser or proxy logs for repeated requests to the same endpoint with varying headers that produce consistent size or timing patterns; look for unusual volumes of cross-origin requests that do not carry credentials.

What your security team should do

• Prioritize patching Firefox and Debian linux packages to the stated fixed versions within the next patch cycle
• Review web applications for reliance on opaque responses or Vary headers and consider adding explicit cache-control or access-control headers where appropriate
• Monitor vulnerability feeds for any increase in EPSS or new exploit reports