Cookie Chaos: Bypassing __Host and __Secure Cookie Prefixes via Parsing Discrepancies
PortSwigger researcher Zakhar Fedotkin reveals critical security vulnerabilities allowing attackers to bypass browser-enforced cookie prefixes, specifically __Host and __Secure. These prefixes are designed to prevent session hijacking and cookie tossing by restricting cookie scope and requiring secure origins. However, discrepancies between how browsers encode cookies and how servers parse them create exploitable gaps. The research demonstrates two primary bypass techniques. First, attackers can use Unicode whitespace characters, such as U+2000, to prefix cookie names. Browsers may treat these as non-restricted cookies, while server-side frameworks like Django and ASP.NET normalize the input by stripping whitespace, effectively recognizing the cookie as a protected __Host variant. Second, legacy parsing modes in Java-based servers like Apache Tomcat can be triggered using specific headers, allowing multiple cookie interpretations that bypass prefix checks. This enables attackers with cross-site scripting (XSS) capabilities to inject high-privilege cookies from untrusted subdomains or insecure origins. The findings highlight significant risks in web application security where browser and server logic diverge, potentially leading to session fixation and account takeover. Developers are urged to review cookie handling mechanisms and ensure consistent parsing standards across their technology stacks to mitigate these sophisticated attack vectors.
Wire timeline
Cookie Chaos: Bypassing __Host and __Secure Cookie Prefixes via Parsing Discrepancies
PortSwigger researcher Zakhar Fedotkin reveals critical security vulnerabilities allowing attackers to bypass browser-enforced cookie prefixes, specifically __Host and __Secure. These prefixes are designed to prevent session hijacking and cookie tossing by restricting cookie scope and requiring secure origins. However, discrepancies between how browsers encode cookies and how servers parse them create exploitable gaps. The research demonstrates two primary bypass techniques. First, attackers can use Unicode whitespace characters, such as U+2000, to prefix cookie names. Browsers may treat these as non-restricted cookies, while server-side frameworks like Django and ASP.NET normalize the input by stripping whitespace, effectively recognizing the cookie as a protected __Host variant. Second, legacy parsing modes in Java-based servers like Apache Tomcat can be triggered using specific headers, allowing multiple cookie interpretations that bypass prefix checks. This enables attackers with cross-site scripting (XSS) capabilities to inject high-privilege cookies from untrusted subdomains or insecure origins. The findings highlight significant risks in web application security where browser and server logic diverge, potentially leading to session fixation and account takeover. Developers are urged to review cookie handling mechanisms and ensure consistent parsing standards across their technology stacks to mitigate these sophisticated attack vectors.
PortSwigger Research