PT-2022-23130 · Unknown · Reactphp Http

Lavish · Published 2022-09-06 · Updated 2022-09-16 · CVE-2022-36032

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ReactPHP HTTP versions 0.7.0 through 1.7.0

Description The issue arises when ReactPHP's HTTP server component processes incoming HTTP cookie values, url-decoding the cookie names. This can lead to confusion between cookies with prefixes like Host- and Secure- and those that decode to such prefixes, allowing an attacker to forge secure cookies.

Recommendations For ReactPHP HTTP versions 0.7.0 through 1.6.x, update to version 1.7.0 to resolve the issue. As a temporary workaround for versions 0.7.0 through 1.6.x, consider placing a reverse proxy in front of the ReactPHP HTTP server to filter out any unexpected Cookie request headers.

Exploit

Fix

RCE

Weakness Enumeration

CWE-565

CWE-20

Related Identifiers

CVE-2022-36032

GHSA-W3W9-VRF5-8MX8

Affected Products

Reactphp Http

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36032.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/react/http/CVE-2022-36032.yaml · Exploit
• https://github.com/reactphp/http/security/advisories/GHSA-w3w9-vrf5-8mx8 · Patch
• https://github.com/reactphp/http/commit/663c9a3b77b71463fa7fcb76a6676ffd16979dd6 · Patch
• https://github.com/reactphp/http/pull/175 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-36032 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-36032 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36032 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-36032 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w3w9-vrf5-8mx8 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-36032 · Vendor Advisory
• https://github.com/reactphp/http · Note
• https://github.com/reactphp/http/releases/tag/v1.7.0 · Note
• https://t.me/cibsecurity/49346 · Telegram Post