CVE-2024-1551

What it actually does

Browser incorrectly processes Set-Cookie headers embedded in multipart HTTP responses when attacker-controlled Content-Type header and response body are present, allowing unauthorized cookie injection.

Why it matters to the business

Attackers may hijack user sessions, impersonate users, or bypass authentication across web applications used by employees and customers, increasing risk of data breaches and compliance violations.

How an attack unfolds

An attacker who can influence a web server's response headers and body crafts a multipart response containing injected Set-Cookie directives; the vulnerable browser honors these cookies, enabling session manipulation or tracking without user interaction.

How to fix it

Upgrade Firefox to version 123 or later, Firefox ESR to 115.8 or later, and Thunderbird to 115.8 or later. Apply vendor patches immediately and verify update deployment across all endpoints.

How to confirm the fix worked

Confirm browser versions meet or exceed the fixed releases; test affected sites with crafted multipart responses to ensure Set-Cookie headers are no longer honored from body content.

Typical attack path

1. Identify or compromise a web server or proxy that returns user-influenced responses
2. Manipulate Content-Type to multipart and embed Set-Cookie in the response body
3. Deliver the malicious response to the victim browser via reflected or stored vector
4. Browser accepts injected cookies, allowing attacker to use them for session access

How to detect it

Review browser update logs and inventory for versions prior to the fixed releases; examine web server logs for unusual multipart responses with Set-Cookie in body content.

What your security team should do

• Prioritize browser updates for all users within the next 30 days
• Monitor vendor advisories for any additional affected products
• Review web application response handling to avoid exposing Content-Type control to untrusted input