CVE-2024-1555: Mozilla Firefox Auth Bypass Vulnerability

CVE-2024-1555 Overview

CVE-2024-1555 is an authentication-related vulnerability in Mozilla Firefox versions prior to 123. The flaw stems from improper enforcement of SameSite cookie attributes when a website is opened through the firefox:// protocol handler. SameSite cookies are designed to prevent cross-site request forgery by restricting cookie transmission across site boundaries. When the firefox:// handler is invoked, the browser fails to honor these restrictions, allowing cookies marked SameSite=Lax or SameSite=Strict to be sent in cross-site contexts. The weakness maps to [CWE-290] Authentication Bypass by Spoofing and was patched in Firefox 123.

Critical Impact
Attackers can bypass SameSite cookie protections to perform cross-site request forgery, session-riding, and unauthorized actions against authenticated user sessions.

Affected Products

Mozilla Firefox versions prior to 123
Platforms running vulnerable Firefox desktop builds (Windows, macOS, Linux)
Any web application relying on SameSite cookie enforcement for CSRF protection in Firefox

Discovery Timeline

2024-02-20 - CVE-2024-1555 published to NVD
2025-03-27 - Last updated in NVD database

Technical Details for CVE-2024-1555

Vulnerability Analysis

The vulnerability resides in Firefox's handling of its custom firefox:// URI scheme. When a navigation is initiated through this protocol handler, the browser's request pipeline does not correctly classify the resulting load as a cross-site context. As a result, the SameSite attribute on existing cookies is not enforced for the target site.

SameSite is the primary in-browser defense against cross-site request forgery. By failing to apply this attribute during firefox:// navigations, the browser transmits authentication cookies that should otherwise be withheld. An attacker who induces a victim to interact with a crafted link can issue authenticated requests to third-party sites under the victim's identity.

The issue is tracked in Mozilla Bug Report #1873223 and addressed in Mozilla Security Advisory MFSA-2024-05.

Root Cause

The root cause is missing or incorrect SameSite policy evaluation in the navigation path triggered by the firefox:// protocol handler. The cookie policy engine receives an incomplete request context, causing it to treat cross-site loads as same-site and attach restricted cookies to outbound requests.

Attack Vector

Exploitation requires user interaction. An attacker hosts or sends a crafted resource that triggers a firefox:// navigation. When the victim clicks the link or visits the malicious page, Firefox follows the handler and emits authenticated requests to a target site without enforcing SameSite restrictions. The result is a CSRF-style compromise of any session the victim holds in the same browser profile.

The vulnerability manifests in the protocol handler navigation path. See Mozilla Bug Report #1873223 for the engineering discussion and fix details.

Detection Methods for CVE-2024-1555

Indicators of Compromise

Browser telemetry or proxy logs showing outbound requests originating from firefox:// URI navigations
Unexpected authenticated POST requests to sensitive endpoints lacking a normal referrer chain
Web server access logs containing cross-origin requests that include session cookies marked SameSite

Detection Strategies

Inspect Firefox version inventory and flag endpoints running builds older than 123
Hunt web application logs for state-changing requests where the Origin or Referer header is missing or inconsistent with the authenticated session
Correlate browser process telemetry with creation of firefox:// URLs in user-visited content or email contents

Monitoring Recommendations

Track Firefox client versions through endpoint inventory tooling and alert on out-of-date installations
Monitor authentication logs for session reuse across unexpected source contexts
Enable web application firewall rules that require valid Origin headers on state-changing requests

How to Mitigate CVE-2024-1555

Immediate Actions Required

Upgrade all Firefox installations to version 123 or later across managed endpoints
Audit web applications to confirm CSRF defenses do not rely solely on SameSite cookies
Communicate the update requirement to users running personal or unmanaged Firefox installations

Patch Information

Mozilla resolved the issue in Firefox 123. Administrators should deploy the update through their standard browser management channels. Reference the Mozilla Security Advisory MFSA-2024-05 for the full advisory and the Mozilla Bug Report #1873223 for technical context.

Workarounds

Enforce CSRF tokens server-side for all state-changing endpoints rather than relying on SameSite alone
Require explicit Origin header validation on sensitive APIs
Restrict registration or invocation of custom URI handlers on managed endpoints through enterprise policy where feasible

bash

# Verify Firefox version on Linux/macOS endpoints
firefox --version

# Expected output for patched builds:
# Mozilla Firefox 123.0 or later