Full Report
From a previous post, the author dug into cookie parsing. They learned that long ago, the Version of a cookie was required. Many servers will downgrade their cookie parser to an older type if the version is found. This was used for WAF bypass techniques. By abusing the parsers of a normal cookie and a legacy cookie, it's possible for both to be valid. In particular, weird things can be done with quotes and double quotes. Chrome, and many other browsers, don't care about the $Version in the cookie header because they don't support it. So, you're able to set this from JavaScript. HTTPOnly is a browser protection to prevent the stealing of cookies with the flag. The author had found an XSS bug but wanted to steal the cookie. They found an endpoint that reflected the session name to be used as well. By using the $Version attribute to downgrade the parser, the ENTIRE quoted string would be sent back, including the PHPSESSID. To do this attack, do the following: Inject a JavaScript cookie with $Version=1,session="deadbeef in it. Notice the double quote at the beginning of it that isn't closed. Append the cookie dummy=qz". This finishes the quoted cookie. Make the CORS request to get the session name. This will return the entire quoted string, including the real session information that was sandwiched in the middle of it. The ordering of the cookies does matter immensely here. Luckily, this is deterministic and can be manipulated using the age of the cookie and the path. I personally love these parser differential bugs! Super fun issue.
Analysis Summary
# Tool/Technique: Cookie Parser Differential (RFC 2109 Downgrade)
## Overview
This technique exploits discrepancies between how modern web browsers and legacy server-side cookie parsers handle the `$Version` attribute. By injecting a legacy-style cookie via JavaScript, an attacker can trigger a parser downgrade on the server, allowing them to "wrap" protected `HttpOnly` cookies within a malformed quoted string. This string is then reflected back to the attacker, effectively bypassing `HttpOnly` protections to steal session tokens.
## Technical Details
- **Type:** Technique (Parser Differential / Protocol Downgrade)
- **Platform:** Web Applications (specifically those using legacy-compliant parsers like certain PHP or Java environments)
- **Capabilities:** Bypassing `HttpOnly` flags, WAF evasion, and session hijacking.
- **First Seen:** Publicly discussed in research contexts regarding RFC 2109/2965 compliance.
## MITRE ATT&CK Mapping
- **TA0006 - Credential Access**
- **T1539 - Steal Web Session Cookie**
- **TA0005 - Defense Evasion**
- **T1211 - Exploitation for Defense Evasion**
- **TA0002 - Execution**
- **T1059.007 - Command and Scripting Interpreter: JavaScript**
## Functionality
### Core Capabilities
- **Parser Downgrading:** Uses the `$Version=1` attribute to force the server-side parser to treat cookies according to legacy RFC 2109 standards rather than modern Netscape or RFC 6265 standards.
- **Quote Injection:** Exploits legacy parsers' handling of double quotes (`"`) to treat all data between two quotes—including separate cookies—as a single value.
- **HttpOnly Bypass:** Allows an attacker with XSS access to read the contents of an `HttpOnly` cookie by forcing the server to reflect the "wrapped" content in a response (e.g., an endpoint reflecting a username or session ID).
### Advanced Features
- **Deterministic Cookie Ordering:** Leverages browser behavior where cookies are sent in an order determined by the specificity of the path and the age of the cookie, ensuring the `HttpOnly` cookie is "sandwiched" correctly between the attacker's injected header and footer cookies.
- **CORS Exploitation:** Combines the parser bug with Cross-Origin Resource Sharing (CORS) requests to extract the reflected data.
## Indicators of Compromise
- **Network Indicators:**
- HTTP `Cookie` headers containing `$Version=1`.
- Cookies containing unbalanced double quotes in JavaScript-accessible cookies (e.g., `session="[value]`).
- Request headers where a single cookie value appears to contain other cookie keys (e.g., `PHPSESSID` appearing inside the value of a different key).
- **Behavioral Indicators:**
- Multiple `document.cookie` assignments in quick succession involving `$Version` or path manipulation to influence cookie sorting.
- XSS payloads targeting specific reflection endpoints that echo back cookie-derived data.
## Associated Threat Actors
- This technique is primarily utilized by sophisticated penetration testers and security researchers, though it is applicable for any actor performing targeted session hijacking via XSS.
## Detection Methods
- **Signature-based detection:**
- WAF rules to detect and block the string `$Version=` within the `Cookie` request header.
- Detection of unbalanced quotes within individual cookie values in the HTTP stream.
- **Behavioral detection:**
- Monitoring for XSS patterns combined with subsequent requests to "reflection" endpoints (e.g., `/api/me` or `/settings`).
- Identifying anomalous cookie ordering or the presence of legacy RFC attributes that are non-standard for the specific application.
## Mitigation Strategies
- **Server-Side Hardening:** Update web server and framework cookie parsers to ignore the `$Version` attribute and strictly adhere to RFC 6265.
- **Header Sanitization:** Configure WAFs or Load Balancers to strip the `$Version` attribute from incoming `Cookie` headers before they reach the application logic.
- **Content Security Policy (CSP):** Implement a strict CSP to prevent the initial XSS required to inject the malicious cookies.
- **Cookie Prefixing:** Use `__Host-` or `__Secure-` prefixes to provide additional layers of protection for sensitive session tokens.
## Related Tools/Techniques
- **Cross-Site Scripting (XSS):** The prerequisite for injecting the malicious cookies.
- **HTTP Parameter Pollution (HPP):** A related concept involving how parsers handle multiple instances of the same parameter.
- **Smuggling/Desync:** General category of attacks relying on differences in how two systems (Proxy vs. Origin) interpret the same data stream.