CVE-2024-5699

What it actually does

The vulnerability causes the browser to perform a case-sensitive check on cookie prefixes such as __Secure instead of the required case-insensitive comparison, resulting in the prefix behaviors (such as forcing the Secure flag) being ignored when capitalization does not match exactly.

Why it matters to the business

Attackers may bypass intended cookie security restrictions, increasing the risk of session hijacking or exposure of sensitive data transmitted over insecure channels.

How an attack unfolds

An attacker positions themselves to set cookies for a target site (via MITM, malicious subdomain, or response injection) and supplies a cookie whose prefix uses incorrect capitalization; the browser fails to enforce the prefix rules, allowing the cookie to be sent without the Secure flag or other protections.

How to fix it

Upgrade all affected Firefox installations to version 127 or later; verify that enterprise update policies enforce the patched release.

How to confirm the fix worked

Confirm installed Firefox version is 127 or higher; test by setting mixed-case prefixes and verifying that Secure and other prefix behaviors are correctly applied.

Typical attack path

1. Position to inject or influence cookie-setting responses for the target domain
2. Create a cookie using a prefix with non-canonical capitalization (e.g., __secure-)
3. Deliver the cookie to the victim's browser
4. Observe or leverage the resulting failure to enforce prefix-mandated security attributes

How to detect it

Inspect web server or proxy logs for cookies containing lowercase or mixed-case prefixes; monitor network traffic for cookies lacking expected Secure flags when prefixes are present.

What your security team should do

• Immediately deploy Firefox 127+ across the environment
• Audit update mechanisms to ensure future browser releases are applied promptly
• Review any internal web applications that rely on cookie prefixes for security controls