CVE-2024-1554

The `fetch()` API and navigation incorrectly shared the same cache, as the cache key did not include the optional headers `fetch()` may contain

Critical ยท published February 20, 2024

CVSS v3.1
9.8
EPSS
0%
Percentile
31.0
In the wild
Unconfirmed
What it is

๐Ÿšจ A sneaky browser cache issue could let attackers serve you fake content! Imagine your browser serving yesterday's stale bread when you were craving freshly baked goods. ๐Ÿ˜ฑ Think of your browser cache as a restaurant pantry. If a mischievous chef replaces a delicious recipe with an old, moldy one, anyone ordering from that pantry will end up with a less-than-appetizing surprise! Under the right conditions, an attacker could poison your local cache, causing your browser to serve up incorrect or malicious responses instead of what you expected. This means you might see manipulated content on a trusted website, leading to potential phishing attacks or misinformation. Absolutely devastating for user trust! ๐Ÿ”ฅ

Put simply

Think of your browser cache as a restaurant pantry. If a mischievous chef replaces a delicious recipe with an old, moldy one, anyone ordering from that pantry will end up with a less-than-appetizing surprise! This vulnerability stems from the `fetch()` API and navigation sharing the same cache without considering optional headers that `fetch()` may include. This oversight could allow a crafted response to be cached and displayed for subsequent requests to the same URL.

What to do

Under the right conditions, an attacker could poison your local cache, causing your browser to serve up incorrect or malicious responses instead of what you expected. This means you might see manipulated content on a trusted website, leading to potential phishing attacks or misinformation. Absolutely devastating for user trust! ๐Ÿ”ฅ Immediate action is required! Upgrade Firefox to version 123 or later to mitigate this vulnerability. Additionally, keep an eye on your cache settings and ensure that your web applications are serving responses correctly. ๐Ÿ›ก๏ธ You've got this! By taking these steps, you can secure your browsing experience and keep the internet safe. ๐Ÿš€

The record
Technical detail
CVSS v3.1
9.8 ยท CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00382 ยท 31.0th percentile
Published
2024-02-20T13:21Z
EPSS history
Timeline
  • 20 FEB 13:21Z
    The `fetch()` API and navigation incorrectly shared the same cache, as the cache key did not include the optional headers `fetch()` may contain
    cvelistv5