Vulnerability Details : CVE-2022-36032
ReactPHP HTTP is a streaming HTTP client and server implementation for ReactPHP. In ReactPHP's HTTP server component versions starting with 0.7.0 and prior to 1.7.0, when ReactPHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like `__Host-` and `__Secure-` confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. This issue is fixed in ReactPHP HTTP version 1.7.0. As a workaround, Infrastructure or DevOps can place a reverse proxy in front of the ReactPHP HTTP server to filter out any unexpected `Cookie` request headers.
Vulnerability category: Input validation
Products affected by CVE-2022-36032
- cpe:2.3:a:reactphp:http:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-36032
0.16%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 33 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-36032
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
3.9
|
1.4
|
NIST | |
|
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
3.9
|
1.4
|
GitHub, Inc. |
CWE ids for CVE-2022-36032
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: security-advisories@github.com (Primary)
-
The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.Assigned by: security-advisories@github.com (Primary)
References for CVE-2022-36032
-
https://github.com/reactphp/http/releases/tag/v1.7.0
Release v1.7.0 · reactphp/http · GitHubRelease Notes;Third Party Advisory
-
https://github.com/reactphp/http/pull/175
Add cookies to request object by legionth · Pull Request #175 · reactphp/http · GitHubIssue Tracking;Patch;Third Party Advisory
-
https://github.com/reactphp/http/commit/663c9a3b77b71463fa7fcb76a6676ffd16979dd6
Do not decode cookie names anymore · reactphp/http@663c9a3 · GitHubPatch;Third Party Advisory
-
https://github.com/reactphp/http/security/advisories/GHSA-w3w9-vrf5-8mx8
ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sent · Advisory · reactphp/http · GitHubIssue Tracking;Patch;Third Party Advisory
Jump to