CVE-2024-47764: cookie accepts cookie name, path, and domain with out of bounds characters
Impact
The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, serialize("userName=<script>alert('XSS3')</script>; Max-Age=2592000; a", value) would result in "userName=<script>alert('XSS3')</script>; Max-Age=2592000; a=test", setting userName cookie to <script> and ignoring value.
A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie.
Patches
Upgrade to 0.7.0, which updates the validation for name, path, and domain.
Workarounds
Avoid passing untrusted or arbitrary values for these fields, ensure they are set by the application instead of user input.
References
https://github.com/jshttp/cookie/pull/167
Other sources
cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.
— NVD
jshttp cookie could allow a remote attacker to bypass security restrictions, caused by improper input validation by the cookie name, path, and domain. By sending a specially crafted request, an attacker could exploit this vulnerability to alter other fields of the cookie.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47764?
CVE-2024-47764 is classified as a high severity vulnerability due to the potential for cross-site scripting (XSS) exploits.
How do I fix CVE-2024-47764?
To fix CVE-2024-47764, update the cookie package to version 0.7.1 or later.
What type of vulnerability is CVE-2024-47764?
CVE-2024-47764 is a cross-site scripting (XSS) vulnerability related to cookie handling.
Which software is affected by CVE-2024-47764?
The vulnerability impacts the 'cookie' package version 0.7.0 and below from npm.
What consequences may arise from CVE-2024-47764?
Exploitation of CVE-2024-47764 could allow attackers to manipulate cookie values, potentially leading to unauthorized actions or data theft.