Cloudanix VulnDB

CVE-2024-2756

Medium · 6.5

CVSS

6.5

EPSS

38.1%

Published

Apr 29, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

Attackers can trick some web applications into accepting fake secure cookies, which might let them access user accounts without permission.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Data Tampering
Component
Library
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Bypasses PHP's __Host- and __Secure- cookie prefix validation due to incomplete prior fix, allowing network or same-site attackers to inject standard insecure cookies that applications treat as protected.

Why it matters to the business

Enables cookie injection attacks that can lead to unauthorized session access or account takeover in PHP applications, increasing risk of data exposure or fraudulent actions; moderate exploit probability with no known ransomware use.

How an attack unfolds

An attacker crafts a Set-Cookie response or leverages a same-site request to deliver an insecure cookie using a name that mimics __Host- or __Secure- prefixes; the PHP application then accepts and uses the cookie as if it were securely set, bypassing intended protections.

How to fix it

Apply the complete fix for the referenced prior issue by upgrading PHP to a version that properly enforces cookie prefix validation; implement application-level cookie name validation and avoid reliance solely on prefix checks.

How to confirm the fix worked

Review PHP source or runtime behavior for cookie prefix handling after updates; test by attempting to set insecure cookies with protected names and confirm they are rejected.

Typical attack path

  1. Identify PHP application handling cookies with prefix security expectations
  2. Craft malicious Set-Cookie header or same-site link delivering insecure cookie with protected name
  3. Victim browser stores the cookie without security flags
  4. PHP application validates and accepts the cookie as __Host- or __Secure- equivalent
  5. Attacker uses resulting session or authentication context for unauthorized actions

How to detect it

Search web server or application logs for unexpected Set-Cookie headers containing __Host- or __Secure- prefixed names originating from untrusted sources; review session handling code for acceptance of insecure cookies.

What your security team should do

  • Prioritize patching PHP environments handling authentication cookies
  • Audit applications for use of __Host- and __Secure- prefixes and add defensive cookie checks
  • Monitor EPSS trend and reassess if exploit code emerges
  • Educate developers on secure cookie implementation beyond prefix reliance

The record

Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:8 apcu-panel 0 5.1.23-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 apcu-panel 0 5.1.18-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 libzip 0 1.7.3-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 libzip 0 1.7.3-1.module_el8.6.0+2739+efabdb8f
AlmaLinux:8 libzip 0 1.7.3-1.module_el8.6.0+3061+6878dd1b
AlmaLinux:8 libzip 0 1.6.1-1.module_el8.10.0+3935+28808425
AlmaLinux:8 libzip 0 1.6.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 libzip 0 1.6.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8 libzip-devel 0 1.7.3-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 libzip-devel 0 1.7.3-1.module_el8.6.0+3061+6878dd1b
AlmaLinux:8 libzip-devel 0 1.6.1-1.module_el8.10.0+3935+28808425
AlmaLinux:8 libzip-devel 0 1.6.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8 libzip-tools 0 1.7.3-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 libzip-tools 0 1.7.3-1.module_el8.6.0+2739+efabdb8f
AlmaLinux:8 libzip-tools 0 1.6.1-1.module_el8.10.0+3935+28808425
AlmaLinux:8 libzip-tools 0 1.6.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 libzip-tools 0 1.6.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8 php 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-bcmath 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-bcmath 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-cli 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-cli 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-common 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-common 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-dba 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-dba 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-dbg 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-dbg 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-devel 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-devel 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-embedded 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-embedded 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-enchant 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-enchant 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-ffi 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-ffi 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-fpm 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-fpm 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-gd 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-gd 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-gmp 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-gmp 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-intl 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-intl 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-json 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-ldap 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-ldap 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-mbstring 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-mbstring 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-mysqlnd 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-mysqlnd 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-odbc 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-odbc 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-opcache 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-opcache 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pdo 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-pdo 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pear 0 1:1.10.14-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 php-pear 0 1:1.10.13-1.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pecl-apcu 0 5.1.23-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 php-pecl-apcu 0 5.1.18-1.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pecl-apcu 0 5.1.18-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 php-pecl-apcu-devel 0 5.1.23-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 php-pecl-apcu-devel 0 5.1.18-1.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pecl-apcu-devel 0 5.1.18-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 php-pecl-rrd 0 2.0.3-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 php-pecl-rrd 0 2.0.1-1.module_el8.3.0+2009+b272fdef
AlmaLinux:8 php-pecl-rrd 0 2.0.1-1.module_el8.4.0+2229+b272fdef
AlmaLinux:8 php-pecl-rrd 0 2.0.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 php-pecl-rrd 0 2.0.1-1.module_el8.6.0+3059+d65eee13
AlmaLinux:8 php-pecl-xdebug 0 2.9.5-1.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pecl-xdebug 0 2.9.5-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 php-pecl-xdebug 0 2.9.5-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8 php-pecl-xdebug3 0 3.2.2-2.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 php-pecl-zip 0 1.22.3-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 php-pecl-zip 0 1.18.2-1.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pecl-zip 0 1.18.2-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 php-pecl-zip 0 1.18.2-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8 php-pgsql 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-pgsql 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-process 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-process 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-snmp 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-snmp 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-soap 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-soap 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-xml 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-xml 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-xmlrpc 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:9 apcu-panel 0 5.1.23-1.module_el9.4.0+65+49ff6472
AlmaLinux:9 apcu-panel 0 5.1.21-1.module_el9.1.0+15+94ba28e4
AlmaLinux:9 php 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-bcmath 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-bcmath 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-cli 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-cli 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-common 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-common 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-dba 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-dba 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-dbg 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-dbg 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-devel 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-devel 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-embedded 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-embedded 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-enchant 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-enchant 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-ffi 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-ffi 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-fpm 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-fpm 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-gd 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-gd 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-gmp 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-gmp 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-intl 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-intl 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-ldap 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-ldap 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-mbstring 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-mbstring 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-mysqlnd 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-mysqlnd 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-odbc 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-odbc 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-opcache 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-opcache 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-pdo 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-pdo 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-pecl-apcu 0 5.1.23-1.module_el9.4.0+65+49ff6472
AlmaLinux:9 php-pecl-apcu 0 5.1.21-1.module_el9.1.0+15+94ba28e4
AlmaLinux:9 php-pecl-apcu-devel 0 5.1.23-1.module_el9.4.0+65+49ff6472
AlmaLinux:9 php-pecl-apcu-devel 0 5.1.21-1.module_el9.1.0+15+94ba28e4
AlmaLinux:9 php-pecl-rrd 0 2.0.3-4.module_el9.1.0+15+94ba28e4
AlmaLinux:9 php-pecl-rrd 0 2.0.3-4.module_el9.4.0+65+49ff6472
AlmaLinux:9 php-pecl-xdebug3 0 3.2.2-2.module_el9.4.0+65+49ff6472
AlmaLinux:9 php-pecl-xdebug3 0 3.1.4-1.module_el9.1.0+15+94ba28e4
AlmaLinux:9 php-pecl-zip 0 1.22.3-1.module_el9.4.0+65+49ff6472
AlmaLinux:9 php-pecl-zip 0 1.20.1-1.module_el9.1.0+15+94ba28e4
AlmaLinux:9 php-pgsql 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-pgsql 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-process 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-process 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-snmp 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-snmp 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-soap 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-soap 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-xml 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-xml 0 8.1.30-1.module_el9.5.0+131+62ecd687
Bitnami libphp 0 8.1.28
Bitnami php 0 8.1.28
Bitnami php 8.1.0 8.1.28
Bitnami php-min 0 8.1.28
Bitnami php-min 8.1.0 8.1.28
Debian:10 php7.3 0 7.3.31-1~deb10u6
Debian:11 php7.4 0 7.4.33-1+deb11u5
Debian:12 php8.2 0 8.2.18-1~deb12u1
Debian:13 php8.2 0 8.2.18-1
Mageia:9 php 0 8.2.18-1.mga9
Red Hat:enterprise_linux:8::appstream apcu-panel 0 0:5.1.23-1.module+el8.10.0+20770+a5eca186
Red Hat:enterprise_linux:8::appstream apcu-panel 0 0:5.1.18-1.module+el8.10.0+22485+a3539972
Red Hat:enterprise_linux:8::appstream libzip 0 0:1.7.3-1.module+el8.10.0+20770+a5eca186
Red Hat:enterprise_linux:8::appstream libzip 0 0:1.6.1-1.module+el8.10.0+22485+a3539972
Red Hat:enterprise_linux:8::appstream libzip-debuginfo 0 0:1.7.3-1.module+el8.10.0+20770+a5eca186
Red Hat:enterprise_linux:8::appstream libzip-debuginfo 0 0:1.6.1-1.module+el8.10.0+22485+a3539972
Red Hat:enterprise_linux:8::appstream libzip-debugsource 0 0:1.7.3-1.module+el8.10.0+20770+a5eca186
Red Hat:enterprise_linux:8::appstream libzip-debugsource 0 0:1.6.1-1.module+el8.10.0+22485+a3539972
Red Hat:enterprise_linux:8::appstream libzip-devel 0 0:1.7.3-1.module+el8.10.0+20770+a5eca186
Red Hat:enterprise_linux:8::appstream libzip-devel 0 0:1.6.1-1.module+el8.10.0+22485+a3539972
Red Hat:enterprise_linux:8::appstream libzip-tools 0 0:1.7.3-1.module+el8.10.0+20770+a5eca186
Red Hat:enterprise_linux:8::appstream libzip-tools 0 0:1.6.1-1.module+el8.10.0+22485+a3539972
Red Hat:enterprise_linux:8::appstream libzip-tools-debuginfo 0 0:1.7.3-1.module+el8.10.0+20770+a5eca186
Red Hat:enterprise_linux:8::appstream libzip-tools-debuginfo 0 0:1.6.1-1.module+el8.10.0+22485+a3539972
Red Hat:enterprise_linux:8::appstream php 0 0:8.2.25-1.module+el8.10.0+22478+9eb07224
Red Hat:enterprise_linux:8::appstream php 0 0:7.4.33-2.module+el8.10.0+22485+a3539972
Red Hat:enterprise_linux:8::appstream php-bcmath 0 0:8.2.25-1.module+el8.10.0+22478+9eb07224
Red Hat:enterprise_linux:8::appstream php-bcmath 0 0:7.4.33-2.module+el8.10.0+22485+a3539972
Red Hat:enterprise_linux:8::appstream php-bcmath-debuginfo 0 0:8.2.25-1.module+el8.10.0+22478+9eb07224
Red Hat:enterprise_linux:8::appstream php-bcmath-debuginfo 0 0:7.4.33-2.module+el8.10.0+22485+a3539972
Red Hat:enterprise_linux:8::appstream php-cli 0 0:8.2.25-1.module+el8.10.0+22478+9eb07224
Red Hat:enterprise_linux:8::appstream php-cli 0 0:7.4.33-2.module+el8.10.0+22485+a3539972
Red Hat:enterprise_linux:8::appstream php-cli-debuginfo 0 0:8.2.25-1.module+el8.10.0+22478+9eb07224
Red Hat:enterprise_linux:8::appstream php-cli-debuginfo 0 0:7.4.33-2.module+el8.10.0+22485+a3539972
Red Hat:enterprise_linux:8::appstream php-common 0 0:8.2.25-1.module+el8.10.0+22478+9eb07224
Red Hat:enterprise_linux:8::appstream php-common 0 0:7.4.33-2.module+el8.10.0+22485+a3539972
Red Hat:enterprise_linux:8::appstream php-common-debuginfo 0 0:8.2.25-1.module+el8.10.0+22478+9eb07224
Red Hat:enterprise_linux:8::appstream php-common-debuginfo 0 0:7.4.33-2.module+el8.10.0+22485+a3539972
Red Hat:enterprise_linux:8::appstream php-dba 0 0:8.2.25-1.module+el8.10.0+22478+9eb07224
Red Hat:enterprise_linux:8::appstream php-dba 0 0:7.4.33-2.module+el8.10.0+22485+a3539972
Red Hat:enterprise_linux:8::appstream php-dba-debuginfo 0 0:8.2.25-1.module+el8.10.0+22478+9eb07224
Red Hat:enterprise_linux:8::appstream php-dba-debuginfo 0 0:7.4.33-2.module+el8.10.0+22485+a3539972
Red Hat:enterprise_linux:8::appstream php-dbg 0 0:8.2.25-1.module+el8.10.0+22478+9eb07224
Red Hat:enterprise_linux:8::appstream php-dbg 0 0:7.4.33-2.module+el8.10.0+22485+a3539972
Red Hat:enterprise_linux:8::appstream php-dbg-debuginfo 0 0:8.2.25-1.module+el8.10.0+22478+9eb07224
Red Hat:enterprise_linux:8::appstream php-dbg-debuginfo 0 0:7.4.33-2.module+el8.10.0+22485+a3539972
Red Hat:enterprise_linux:8::appstream php-debuginfo 0 0:8.2.25-1.module+el8.10.0+22478+9eb07224
Red Hat:enterprise_linux:8::appstream php-debuginfo 0 0:7.4.33-2.module+el8.10.0+22485+a3539972

Related vulnerabilities