Executive brief
The cookie library is used to serialize and parse HTTP cookies in Node.js applications. A flaw in input validation allows attackers to inject additional cookie fields (like Max-Age) by providing out-of-bounds characters in cookie name, path, or domain parameters. This could result in unexpected cookie values, altered cookie behavior, or client-side XSS if the cookie value is reflected in HTML.
Technical details
The vulnerability is an input validation bypass (CWE-74) in the cookie serialization logic. The vulnerable code used the RFC7230 field-content regex to validate individual cookie fields (name, path, domain), but that regex is intended for the entire cookie header, not individual parts. Each field has tighter restrictions per RFC6265. An attacker who controls cookie name, path, or domain values can inject characters like semicolons and special characters to break out of the field and set other cookie attributes. For example, a crafted cookie name "userName=<script>; Max-Age=2592000; a" would be serialized as "userName=<script>; Max-Age=2592000; a=test", changing the interpreted cookie value and attributes. Attack precondition: the application must pass untrusted input to the cookie serialize() function for these fields. The fix (released in version 0.7.0) narrows validation regex for name, path, and domain to match RFC6265 specifications.
Affected products
- jshttp cookie <0.7.0
Timeline
- 2024-10-04: disclosed
- 2024-10-04: patched: version 0.7.0 released