CVE-2024-1551: Mozilla Firefox XSS Vulnerability

CVE-2024-1551 Overview

CVE-2024-1551 is a response header injection vulnerability affecting Mozilla Firefox, Firefox ESR, and Thunderbird. The browser incorrectly honored Set-Cookie response headers embedded within multipart HTTP responses. An attacker who could control the Content-Type response header and part of the response body could inject Set-Cookie headers that the browser would accept. This enabled cookie manipulation attacks against users visiting affected origins. The flaw is categorized under [CWE-565] (Reliance on Cookies without Validation and Integrity Checking) and requires user interaction to trigger.

Critical Impact
Attackers can inject arbitrary cookies into a victim's browser session by smuggling Set-Cookie headers through multipart response body parts, enabling session fixation and integrity violations against the affected origin.

Affected Products

Mozilla Firefox versions prior to 123
Mozilla Firefox ESR versions prior to 115.8
Mozilla Thunderbird versions prior to 115.8 (and Debian Linux 10 packages)

Discovery Timeline

2024-02-20 - CVE-2024-1551 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1551

Vulnerability Analysis

The vulnerability resides in how Firefox's networking stack processed multipart HTTP responses, typically those served with Content-Type: multipart/x-mixed-replace or similar multipart media types. Each part of a multipart response can include its own header block. The browser incorrectly promoted Set-Cookie headers from these inner part headers to the parent HTTP response, treating them as if the origin server had issued them.

Because part boundaries and part headers can be influenced by data written into the response body, an attacker with partial control over response contents could smuggle a Set-Cookie directive across the trust boundary. The browser then stored the injected cookie for the responding origin. Refer to the Mozilla Bug Report #1864385 for the upstream tracking.

Root Cause

The root cause is improper trust separation between multipart part headers and top-level HTTP response headers. Firefox's multipart parser did not filter Set-Cookie when transferring per-part metadata to the response object. Any endpoint that reflected user data into a multipart body and permitted attacker influence over the Content-Type was reachable.

Attack Vector

Exploitation requires an attacker to lure a user to a page or endpoint on a vulnerable origin that returns attacker-influenced multipart content. Typical targets include file upload previews, image proxies, and generated multipart streams that reflect query parameters or uploaded content. The victim's browser then stores injected cookies, enabling session fixation, preference tampering, or bypass of cookie-based CSRF defenses.

No verified public exploit code has been released for this issue. The vulnerability mechanism and remediation are documented in Mozilla Security Advisory MFSA-2024-05.

Detection Methods for CVE-2024-1551

Indicators of Compromise

Unexpected cookies appearing in browser storage for origins that serve multipart content such as file previews or streaming endpoints.
HTTP responses with Content-Type: multipart/* where reflected body content includes literal header sequences such as Set-Cookie: followed by CRLF.
Client-side session anomalies where a user's session identifier changes without an authenticated login event.

Detection Strategies

Inspect web server access logs and proxy logs for multipart responses that echo user-controlled input into headers or part boundaries.
Deploy web application firewall rules that flag Set-Cookie strings appearing inside request bodies or query parameters destined for endpoints returning multipart content.
Correlate browser user-agent versions from telemetry against the vulnerable version ranges (Firefox < 123, ESR < 115.8, Thunderbird < 115.8).

Monitoring Recommendations

Track outbound HTTP responses from internal applications that set Content-Type dynamically from user input.
Alert on session token rotation events that do not correspond to authentication or logout flows.
Monitor Debian package inventories for firefox-esr and thunderbird versions below the fixed releases referenced in the Debian LTS Announcement March 2024.

How to Mitigate CVE-2024-1551

Immediate Actions Required

Upgrade Firefox to version 123 or later, Firefox ESR to 115.8 or later, and Thunderbird to 115.8 or later.
Apply Debian LTS package updates for firefox-esr and thunderbird on Debian 10 systems as described in the Debian LTS announcements.
Audit internal web applications that emit multipart responses and validate that user input cannot influence the Content-Type header or part boundaries.

Patch Information

Mozilla addressed the vulnerability in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Full remediation details are published in Mozilla Security Advisory MFSA-2024-05, MFSA-2024-06, and MFSA-2024-07. Downstream fixes for Debian are tracked in the Debian LTS Announcement March 2024.

Workarounds

Restrict server responses to non-multipart content types where feasible, especially for endpoints that reflect user input.
Sanitize and canonicalize any user-controlled data before including it in HTTP response bodies to strip CRLF sequences.
Enforce strict Content-Type allowlists at reverse proxies to prevent downstream services from returning attacker-influenced multipart media types.

bash

# Configuration example: nginx rule to block multipart responses from a reflective endpoint
location /preview {
    proxy_pass http://backend;
    proxy_hide_header Content-Type;
    add_header Content-Type "application/octet-stream" always;
}