CVE-2022-36032
MEDIUMReactPHP HTTP 0.7.0-1.7.0 - Cookie Prefix Spoofing via URL Decoding
Title source: llmDescription
ReactPHP HTTP is a streaming HTTP client and server implementation for ReactPHP. In ReactPHP's HTTP server component versions starting with 0.7.0 and prior to 1.7.0, when ReactPHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like `__Host-` and `__Secure-` confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. This issue is fixed in ReactPHP HTTP version 1.7.0. As a workaround, Infrastructure or DevOps can place a reverse proxy in front of the ReactPHP HTTP server to filter out any unexpected `Cookie` request headers.
References (4)
Core 4
Core References
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://github.com/reactphp/http/security/advisories/GHSA-w3w9-vrf5-8mx8
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://github.com/reactphp/http/pull/175
Patch, Third Party Advisory x_refsource_misc
https://github.com/reactphp/http/commit/663c9a3b77b71463fa7fcb76a6676ffd16979dd6
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/reactphp/http/releases/tag/v1.7.0
Scores
CVSS v3
5.3
EPSS
0.0074
EPSS Percentile
49.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-20
CWE-565
Status
published
Products (2)
react/http
0.7.0 - 1.7.0Packagist
reactphp/http
0.7.0 - 1.7.0
Published
Sep 06, 2022
Tracked Since
Feb 18, 2026