PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Bypassing WAFs with the phantom $Version cookie

portswigger.net | research | #web-security | #cookies | #waf-bypass | #django | #parser-discrepancies | #spring
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Legacy $Version cookies downgrade parsers into RFC2109 mode, and frameworks — Flask, Django, PHP, Spring — disagree on the result. The discrepancies can be abused to smuggle attacks past WAFs.
Published
Collected

Related coverage

research · portswigger.net
Cookie Chaos: How to bypass __Host and __Secure cookie prefixes
Unicode whitespace bypasses __Host- and __Secure- cookie prefixes: browsers treat the cookie as unrestricted, but servers such as Django and ASP.NET trim the character and honour the protected name.
research · portswigger.net
What's in a tag name? JavaScript, apparently
This research provides technical context that security teams can use for monitoring and validation.
research · portswigger.net
The Fragile Lock: Novel Bypasses For SAML Authentication
Novel SAML signature-wrapping attacks — attribute pollution, namespace confusion and Void Canonicalization — achieve full authentication bypass in Ruby and PHP libraries, including GitLab Enterprise.
research · portswigger.net
Gotta cache 'em all: bending the rules of web cache exploitation
Doyhenard's research exploits URL parser discrepancies and RFC ambiguities between CDNs and origins — delimiters, normalization, static extensions — achieving arbitrary cache poisoning and deception.
research · portswigger.net
Stealing HttpOnly cookies with the cookie sandwich technique
The cookie sandwich technique wraps a session cookie between quoted values and legacy $Version attributes, making Tomcat misparse the header and expose HttpOnly cookies to scripts.
research · portswigger.net
Splitting the email atom: exploiting parsers to bypass access controls
Email parser discrepancies — quoted values, Unicode overflows, encoded-word, malformed Punycode — become access control bypasses and RCE, with cases against GitHub, Zendesk, GitLab and Joomla.
Back