In ReactPHP's HTTP server component versions below v1.7.0, when ReactPHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host-
and __Secure-
confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-7070 and CVE-2020-8184 for more information.
v1.7.0
Infrastructure or DevOps can place a reverse proxy in front of the ReactPHP HTTP server to filter out any unexpected Cookie
request headers.
If you have any questions or comments about this advisory:
{ "nvd_published_at": "2022-09-06T19:15:00Z", "github_reviewed_at": "2022-09-16T18:48:53Z", "severity": "MODERATE", "github_reviewed": true, "cwe_ids": [ "CWE-20", "CWE-565" ] }