CVE-2024-1555

What it actually does

The vulnerability allows SameSite cookie protections to be bypassed when a website is opened via the firefox:// protocol handler, potentially exposing cookies that should be restricted to same-site requests.

Why it matters to the business

Attackers could gain unauthorized access to user sessions or sensitive data protected by SameSite cookies in Firefox browsers, leading to potential account compromises without requiring user interaction beyond clicking a link. Low exploit maturity and stable low EPSS indicate limited real-world risk despite the age of the issue.

How an attack unfolds

An attacker creates a malicious link using the firefox:// protocol that points to a target website. When the victim clicks it in Firefox, the browser opens the site without properly enforcing SameSite cookie attributes, allowing the attacker to access or set cookies cross-site.

How to fix it

Upgrade Firefox to version 123 or later to ensure SameSite cookies are properly respected for firefox:// protocol handlers.

How to confirm the fix worked

Verify the Firefox version is at least 123. Test by attempting to access a site with SameSite cookies via a firefox:// link and confirm cookies are not leaked or accessible cross-site.

Typical attack path

1. Craft a firefox:// URL pointing to the target site
2. Trick user into clicking the link via phishing or other means
3. Browser loads the site bypassing SameSite cookie enforcement
4. Exfiltrate or abuse cookies for session hijacking or unauthorized actions

How to detect it

Review browser logs or proxy logs for unusual firefox:// protocol usage leading to authenticated sessions. Look for cross-site requests that should have been blocked by SameSite.

What your security team should do

• Prioritize updating all Firefox installations to version 123 or newer
• Review web application cookie configurations to ensure SameSite attributes are set appropriately
• Monitor network logs for unusual firefox:// protocol usage