CVE-2024-1554

What it actually does

The fetch() API and navigation requests incorrectly shared a browser cache key that omitted optional request headers, allowing a fetch() response to be stored and later served for a navigation to the same URL.

Why it matters to the business

Users of affected browsers may be shown stale or attacker-controlled content instead of the expected page, which can undermine trust in web applications and enable targeted content manipulation attacks.

How an attack unfolds

An attacker crafts a fetch() request that includes specific headers to a target URL, stores a malicious response in the shared cache, then induces a victim to navigate to the same URL where the poisoned cached response is delivered instead of the legitimate one.

How to fix it

Upgrade Firefox to version 123 or later to ensure fetch() and navigation requests use separate cache keys that incorporate optional headers.

How to confirm the fix worked

Confirm the browser version is 123 or higher; test by issuing fetch requests with varying headers followed by navigation and verifying distinct responses are received.

Typical attack path

1. Identify a target URL that can be fetched with additional headers.
2. Issue a fetch() request containing attacker-controlled headers to prime the cache with a chosen response.
3. Trick the victim into navigating directly to the same URL via link, redirect, or social engineering.
4. Victim receives the cached poisoned response instead of the expected server content.

How to detect it

Client-side cache poisoning leaves minimal server-side artifacts; review browser cache inspection tools or proxy logs for unexpected responses that match previously fetched content with differing headers.

What your security team should do

• Prioritize deployment of Firefox 123+ across all managed endpoints.
• Monitor vendor release notes for any related cache-handling changes in subsequent updates.
• Educate users on verifying browser version and applying updates promptly.