cookie accepts cookie name, path, and domain with out of bounds characters

Description

The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, serialize("userName=<script>alert('XSS3')</script>; Max-Age=2592000; a", value) would result in "userName=<script>alert('XSS3')</script>; Max-Age=2592000; a=test", setting userName cookie to <script> and ignoring value.

Recommendation

Update the cookie package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.7.0
• Patched version(s): 0.7.0

References

• GHSA-pxg6-pf52-xh8x
• CVE-2024-47764
• CWE-74
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Server crashes on invalid Cloud Function or Cloud Job name - CVE-2024-29027
• Nuxt Devtools has a Path Traversal: '../filedir - CVE-2024-23657
• Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability - CVE-2024-47818
• Path traversal in webpack-dev-middleware - CVE-2024-29180

Tags:

npm

cookie