In early 2024, a serious vulnerability was discovered in Mozilla Firefox, Firefox ESR, and Thunderbird that could let attackers inject unauthorized cookies into a user's browser. This flaw, identified as CVE-2024-1551, was caused by browsers incorrectly processing Set-Cookie headers in multipart HTTP responses. In this post, we'll break down how this vulnerability happened, what the exploit looked like, and how you can protect yourself.

What Is CVE-2024-1551?

CVE-2024-1551 is a vulnerability where browsers incorrectly honored Set-Cookie headers that were *inside* multipart HTTP responses. This means if the attacker could manipulate part of the HTTP response (especially the Content-Type header and some of the body), they could set cookies in your browser that shouldn't be allowed.

How Does the Vulnerability Work?

Think of a typical website response: when a server wants to make your browser store a cookie, it sends a Set-Cookie HTTP header. Web browsers are supposed to only honor these headers if they're in the top-level response headers—not buried inside multipart bodies.

But with this bug, Firefox and Thunderbird would *accept and process* Set-Cookie headers that showed up in certain multipart response parts, giving attackers a sneaky way to set cookies.

Scenario

1. Attacker Controls Response: Imagine a bad actor can craft server responses that set the Content-Type to something like multipart/x-mixed-replace; boundary=foo.
2. Injects Multipart Body: Within the multipart response, attackers insert a fake HTTP header that looks like Set-Cookie:.
3. Browser Parses Bad Header: The vulnerable browsers see this Set-Cookie and actually process it—storing malicious cookies.

Here's an example of what an attacker's response might look like

HTTP/1.1 200 OK
Content-Type: multipart/x-mixed-replace; boundary=foo

--foo
Content-Type: text/html
Set-Cookie: session=evil; Domain=.victim.com; Path=/

<html>
  <body>This is a part of the multipart response!</body>
</html>
--foo--

In this example, even though the Set-Cookie is inside the body (not the main HTTP headers!), Firefox would *actually create* the session=evil cookie for .victim.com.

To pull off this attack, the attacker needs some control

- Control Over Content-Type Header: Must set it to multipart/....
- Partial Control Over the Response Body: Needs to craft a valid multipart response, including the rogue Set-Cookie header.

This could happen if the attacker manages to trick a server into echoing or reflecting data, or in server-side request forgery (SSRF) scenarios.

Real-World Exploit Path

A common exploitation path is abusing open proxy servers or unvalidated file upload endpoints, where attackers force the server to reflect crafted Set-Cookie headers in a multipart response.

- Mozilla Security Advisory for Firefox 123
- CVE-2024-1551 Detail at NVD
- Firefox Bugzilla Report *(see for technical details)*

The Fix

Mozilla fixed the issue by making sure Set-Cookie headers inside multipart bodies are ignored, just like other browsers.

Conclusion

CVE-2024-1551 is a great example of why careful HTTP header handling is critical. Even small parsing bugs can lead to major security headaches! If you use Firefox, Thunderbird, or any Mozilla product, make sure to update as soon as possible to stay safe.

Timeline

Published on: 02/20/2024 14:15:08 UTC
Last modified on: 11/19/2024 22:35:04 UTC