New Cookie Sandwich Technique Allows Stealing of HttpOnly Cookies

New Cookie Sandwich Technique Allows Stealing of HttpOnly Cookies
Summary: The โ€œCookie Sandwich Attackโ€ exploits inconsistencies in cookie parsing by web servers, allowing attackers to manipulate HTTP headers and access sensitive session cookies. By leveraging legacy cookie standards and exploiting cross-origin vulnerabilities, the attack poses a significant threat to poorly configured web applications. Proper adherence to standards and rigorous input sanitization are crucial in preventing such vulnerabilities.

Affected: Web applications and frameworks (e.g., Apache Tomcat, Flask)

Keypoints :

  • Attackers manipulate cookie headers to expose sensitive data, including those with the HttpOnly flag.
  • Different cookie parsing behaviors across web servers, frameworks, and browsers can be exploited.
  • Preventative measures include adherence to modern standards, input sanitization, and securing cookie attributes.

Source: https://gbhackers.com/new-cookie-sandwich-technique-allows-stealing-of-httponly-cookies/