PHP parses encoded cookie names so malicious `__Host-` cookies can be sent

An attacker can exploit CVE-2020-7070 to forge secure cookies by manipulating the URL decoding process of HTTP cookie names. Specifically, they can craft cookie names that, after decoding, resemble reserved prefixes like '__Host', which are typically used for cookies intended to be accessible across subdomains. This allows an attacker to inject malicious cookies that appear legitimate, potentially leading to session hijacking and unauthorized access to sensitive data. The impact is particularly severe for applications relying on secure cookies for authentication and authorization, as an attacker could impersonate legitimate users.

Applications using PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23, and 7.4.x below 7.4.11 are at risk. This includes web applications relying on secure cookies for authentication, authorization, or session management. Shared hosting environments where users have limited control over the PHP version are particularly vulnerable.

• php: Check PHP version using php -v. If the version is affected (≤7.4.11), investigate further. • generic web: Examine access logs for unusual cookie names or patterns that might indicate attempted exploitation. Look for cookies with prefixes like '__Host' that are not expected. • generic web: Use curl to test cookie setting and retrieval with manipulated names to see if the application is vulnerable.

curl -v -b 'test=1; __Host=malicious' http://your-php-application

1. 2020-10-02Disclosure

   disclosure

1. Gereserveerd2020-01-15
2. Gepubliceerd2020-10-02
3. Gewijzigd2024-09-16
4. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2020-7070 is to upgrade to a patched version of PHP. Upgrade to PHP 7.4.11 or later to resolve this vulnerability. If upgrading is not immediately feasible, consider implementing stricter cookie validation on the application side to prevent the acceptance of cookies with unexpected prefixes. Web application firewalls (WAFs) can also be configured to filter out requests containing suspicious cookie names. After upgrading, verify the fix by attempting to set a cookie with a manipulated name and confirming that it is rejected.