CVE-2022-31629: medium-severity vulnerability in PHP
$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
PHP automatically converts dots in cookie names to underscores, allowing attackers to bypass security protections meant to prevent tampering with sensitive cookies. An attacker can set a regular cookie that PHP mistakenly treats as a protected one, potentially compromising security.
Attackers can exploit PHP's cookie name sanitization (dot-to-underscore conversion) to bypass `__Host-` and `__Secure-` cookie prefixes, which are designed to prevent cookie tampering. By crafting a cookie name with dots that resolves to a protected prefix after conversion, an attacker on the same network or site can inject malicious cookies that the application trusts as secure, undermining cookie integrity validation.
In the same product, most dangerous first.