CVE-2022-31629

MEDIUM

PHP <7.4.31, 8.0.24, 8.1.11 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2022-31629. PoCs published by silnex.

AI-analyzed exploit summary This PoC demonstrates CVE-2022-31629, a vulnerability in PHP where cookies with names starting with '__Host-' can be bypassed by prefixing them with '..' due to a parsing flaw. The exploit manipulates the CSRF token validation by injecting a malicious cookie and submitting it via a POST request.

Description

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.

Exploits (1)

nomisec WORKING POC 3 stars
by silnex · poc
https://github.com/silnex/CVE-2022-31629-poc

This PoC demonstrates CVE-2022-31629, a vulnerability in PHP where cookies with names starting with '__Host-' can be bypassed by prefixing them with '..' due to a parsing flaw. The exploit manipulates the CSRF token validation by injecting a malicious cookie and submitting it via a POST request.

Classification
Working Poc 100%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: PHP versions 8.1.10 and 8.1.11
No auth needed
Prerequisites: A web application using PHP with '__Host-' prefixed cookies for CSRF protection
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (14)

Core 14
Core References
Third Party Advisory vendor-advisory
https://www.debian.org/security/2022/dsa-5277
Third Party Advisory vendor-advisory
https://security.gentoo.org/glsa/202211-03
Mailing List, Third Party Advisory mailing-list
https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html
Exploit, Permissions Required, Vendor Advisory
https://bugs.php.net/bug.php?id=81727

Scores

CVSS v3 6.5
EPSS 0.4934
EPSS Percentile 98.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-1284 CWE-20
Status published
Products (6)
debian/debian_linux 10.0
debian/debian_linux 11.0
fedoraproject/fedora 35
fedoraproject/fedora 36
fedoraproject/fedora 37
php/php < 7.4.31
Published Sep 28, 2022
Tracked Since Feb 18, 2026