New 'Cookie Sandwich' Technique Bypasses HttpOnly Security Flags
PortSwigger researcher Zakhar Fedotkin has introduced a novel web security vulnerability known as the 'cookie sandwich' technique, which allows attackers to bypass the HttpOnly flag on specific server configurations. This method exploits how certain web servers, such as Apache Tomcat and Python-based frameworks like Flask, parse legacy cookies and special characters. By injecting crafted cookie values containing quotes and semicolons via client-side JavaScript, attackers can trick the server into misinterpreting the cookie header structure. Consequently, sensitive HttpOnly cookies, such as session identifiers, become exposed within the response data. The research highlights real-world implications, demonstrating how this technique can be combined with Cross-Site Scripting (XSS) vulnerabilities and insecure analytics implementations to steal user session tokens. Fedotkin successfully tested this approach against an application protected by AWS WAF, utilizing a specific event handler bypass to execute malicious scripts. This finding underscores the risks associated with improper cookie parsing logic and the importance of robust input validation in web applications, offering a new vector for session hijacking attacks despite existing browser security measures.
Wire timeline
New 'Cookie Sandwich' Technique Bypasses HttpOnly Security Flags
PortSwigger researcher Zakhar Fedotkin has introduced a novel web security vulnerability known as the 'cookie sandwich' technique, which allows attackers to bypass the HttpOnly flag on specific server configurations. This method exploits how certain web servers, such as Apache Tomcat and Python-based frameworks like Flask, parse legacy cookies and special characters. By injecting crafted cookie values containing quotes and semicolons via client-side JavaScript, attackers can trick the server into misinterpreting the cookie header structure. Consequently, sensitive HttpOnly cookies, such as session identifiers, become exposed within the response data. The research highlights real-world implications, demonstrating how this technique can be combined with Cross-Site Scripting (XSS) vulnerabilities and insecure analytics implementations to steal user session tokens. Fedotkin successfully tested this approach against an application protected by AWS WAF, utilizing a specific event handler bypass to execute malicious scripts. This finding underscores the risks associated with improper cookie parsing logic and the importance of robust input validation in web applications, offering a new vector for session hijacking attacks despite existing browser security measures.
PortSwigger Research