CVE-2024-1554
📋 TL;DR
This vulnerability allows attackers to poison browser caches by using fetch() API requests with specific headers, causing subsequent navigations to the same URL to serve malicious cached content instead of legitimate responses. It affects Firefox users on versions below 123, potentially leading to phishing, malware delivery, or content manipulation.
💻 Affected Systems
- Mozilla Firefox
📦 What is this software?
Firefox by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Attackers could serve malicious content (phishing pages, malware) to users who believe they are visiting legitimate sites, leading to credential theft, system compromise, or financial fraud.
Likely Case
Targeted phishing attacks where users are tricked into entering credentials on spoofed login pages that appear to be legitimate sites they previously visited.
If Mitigated
Users would see legitimate content as intended, with no cache poisoning or content manipulation.
🎯 Exploit Status
Exploitation requires specific conditions where attackers can control fetch() requests and users navigate to the same URLs. No public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 123
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2024-05/
Restart Required: Yes
Instructions:
1. Open Firefox. 2. Click the menu button (three horizontal lines). 3. Select Help > About Firefox. 4. Firefox will automatically check for updates and install Firefox 123. 5. Restart Firefox when prompted.
🔧 Temporary Workarounds
Disable browser cache
allPrevents cache poisoning by disabling browser caching entirely, though this will impact performance.
about:config > browser.cache.disk.enable = false
about:config > browser.cache.memory.enable = false
Use private browsing mode
allPrivate/incognito sessions don't persist cache between sessions, preventing cache poisoning attacks.
Ctrl+Shift+P (Windows/Linux) or Cmd+Shift+P (macOS)
🧯 If You Can't Patch
- Use alternative browsers (Chrome, Edge, Safari) that are not affected by this specific vulnerability.
- Implement strict network filtering and monitoring for suspicious fetch() requests to potentially malicious domains.
🔍 How to Verify
Check if Vulnerable:
Check Firefox version: Open Firefox > Menu > Help > About Firefox. If version is below 123, the system is vulnerable.Check Version:
firefox --versionVerify Fix Applied:
After updating, verify Firefox version is 123 or higher using the same steps.📡 Detection & Monitoring
Log Indicators:
- Unusual fetch() requests with custom headers to the same URLs users frequently visit
- Multiple cache hits for URLs that should have unique responses
Network Indicators:
- HTTP requests with unusual headers patterns from browser clients
- Repeated requests to the same URL with varying headers
SIEM Query:
source="firefox_logs" AND (event="fetch_request" AND header_count > normal_baseline) OR (event="cache_hit" AND url IN sensitive_sites)