CVE-2022-31629: PHP Cookie Prefix XSS Vulnerability

CVE-2022-31629 Overview

CVE-2022-31629 is an input validation vulnerability affecting PHP versions before 7.4.31, 8.0.24, and 8.1.11. This security flaw enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is then incorrectly treated as a __Host- or __Secure- cookie by PHP applications. This cookie prefix bypass undermines critical security mechanisms designed to protect cookie integrity and prevent session hijacking attacks.

Critical Impact

Attackers can bypass cookie security prefixes (__Host- and __Secure-), potentially enabling session hijacking, authentication bypass, and cross-site attacks against PHP web applications that rely on these cookie security mechanisms.

Affected Products

• PHP versions before 7.4.31
• PHP versions 8.0.x before 8.0.24
• PHP versions 8.1.x before 8.1.11
• Fedora 35, 36, and 37
• Debian Linux 10.0 and 11.0

Discovery Timeline

• 2022-09-28 - CVE-2022-31629 published to NVD
• 2025-11-04 - Last updated in NVD database

Technical Details for CVE-2022-31629

Vulnerability Analysis

This vulnerability stems from improper input validation in PHP's cookie handling mechanism. The __Host- and __Secure- cookie prefixes were introduced as security measures defined in RFC 6265bis to provide additional protection for cookies. The __Host- prefix requires cookies to be set with the Secure attribute, have no Domain attribute, and have a Path of /. The __Secure- prefix requires cookies to be set with the Secure attribute.

The vulnerability allows attackers to craft cookies that bypass these security prefix validations. When a network attacker (such as one performing a man-in-the-middle attack) or a same-site attacker sets a standard insecure cookie, PHP applications incorrectly interpret it as a protected __Host- or __Secure- cookie. This breaks the trust model that applications rely upon when using these prefixed cookies for security-sensitive operations like session management and CSRF protection.

Root Cause

The root cause is classified under CWE-20 (Improper Input Validation) and CWE-1284 (Improper Validation of Specified Quantity in Input). PHP's cookie parsing logic fails to properly validate that cookies with security prefixes were actually set with the required security attributes. The parser accepts cookies that match the prefix naming convention without verifying the security context under which they were originally set, allowing attackers to inject malicious cookies that masquerade as secure ones.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker positioned on the network path (e.g., via a compromised router, public WiFi, or DNS spoofing) can inject HTTP responses containing malicious cookies. Same-site attackers who control a subdomain or related domain can also exploit this vulnerability. The attack flow involves:

1. The attacker intercepts or initiates an HTTP connection to the target user
2. A malicious Set-Cookie header is injected with a cookie name beginning with __Host- or __Secure-
3. The victim's browser stores the cookie without enforcing the prefix security requirements
4. When the victim visits the legitimate PHP application, the application incorrectly trusts the attacker-controlled cookie

Since no public exploit code is currently available, the specific implementation details vary based on the attack scenario. For technical details on the vulnerability mechanism, refer to PHP Bug Report #81727.

Detection Methods for CVE-2022-31629

Indicators of Compromise

• Unexpected or duplicate cookies with __Host- or __Secure- prefixes in application logs
• Session inconsistencies or authentication anomalies that may indicate cookie manipulation
• HTTP traffic containing Set-Cookie headers with security-prefixed cookies over non-HTTPS connections
• User reports of session hijacking or unauthorized account access

Detection Strategies

• Monitor web application logs for suspicious cookie patterns, particularly multiple cookies with identical security prefixes
• Implement web application firewall (WAF) rules to detect and block attempts to set security-prefixed cookies from unauthorized sources
• Deploy network intrusion detection systems (IDS) to identify HTTP response injection attempts
• Audit PHP version inventory across all systems to identify vulnerable installations

Monitoring Recommendations

• Enable verbose cookie logging in web servers and PHP applications to track cookie creation and modification
• Implement session validation mechanisms that verify cookie integrity beyond prefix checking
• Configure SIEM rules to alert on anomalous cookie-related activity patterns
• Monitor for network-level attacks such as ARP spoofing or DNS hijacking that could enable this vulnerability

How to Mitigate CVE-2022-31629

Immediate Actions Required

• Upgrade PHP immediately to version 7.4.31, 8.0.24, 8.1.11, or later depending on your PHP branch
• Review application code that relies on __Host- or __Secure- cookie prefixes for security decisions
• Implement additional session validation measures that do not solely rely on cookie prefixes
• Ensure all cookie-sensitive communications occur exclusively over HTTPS with proper certificate validation

Patch Information

Security patches addressing this vulnerability are available from PHP and major Linux distributions. The official fix is documented in PHP Bug Report #81727. Distribution-specific advisories include:

• Debian Security Advisory DSA-5277
• Debian LTS Security Announcement
• Gentoo GLSA-202211-03
• NetApp Security Advisory

Workarounds

• If immediate patching is not possible, implement server-side session validation that does not rely solely on cookie prefix security
• Deploy a reverse proxy or WAF that can filter and validate cookies before they reach PHP applications
• Enforce HTTPS-only communication with HTTP Strict Transport Security (HSTS) to reduce the attack surface for network-based attackers
• Consider implementing additional cookie validation logic within the application layer as a defense-in-depth measure

# Verify PHP version and upgrade on Debian/Ubuntu
php -v
sudo apt update && sudo apt install php8.1

# Verify PHP version and upgrade on RHEL/Fedora
php -v
sudo dnf update php