CVE-2022-39284: CodeIgniter Cookie Misconfiguration

Background

CodeIgniter is a PHP full-stack web framework that provides developers with a set of tools and libraries for building web applications. It offers features such as a powerful MVC architecture, database abstraction, and security mechanisms. However, in versions prior to 4.2.7, CodeIgniter is vulnerable to a misconfiguration in the handling of cookies. This vulnerability allows an attacker to access cookie values that should be protected, potentially leading to unauthorized access or data exposure. It is important for CodeIgniter users to be aware of this issue and take appropriate measures to mitigate the risk.

Vulnerability Detail

The vulnerability in CodeIgniter arises from the incorrect handling of the $secure and $httponly options in the Config\Cookie class. When these options are set to true, they should ensure that cookies are only sent over secure connections and are not accessible to client-side scripts. However, in affected versions, these options are not properly reflected in the set_cookie() and Response::setCookie() methods. As a result, cookie values are exposed to scripts, potentially allowing an attacker to steal sensitive information. It is important to note that this vulnerability does not affect session cookies, which are handled separately. CodeIgniter users are strongly advised to upgrade to version 4.2.7 or later to address this vulnerability.

Workaround

If upgrading to the latest version of CodeIgniter is not immediately feasible, users can manually construct their cookies by setting the options in code or by using the Cookie objects. Here are examples of each workaround:

1. Setting options in code:

$cookieConfig = new Config\Cookie();
$cookieConfig->secure = true;
$cookieConfig->httponly = true;

// Use the cookie config when setting the cookie
$cookie = new Cookie('cookie_name', 'cookie_value', $cookieConfig);

// Set the cookie
$cookie->set();

2. Using Cookie objects:

$cookieConfig = new Config\Cookie();
$cookieConfig->secure = true;
$cookieConfig->httponly = true;

// Create a new Cookie object with the desired options
$cookie = new Cookie('cookie_name', 'cookie_value', $cookieConfig);

// Set the cookie
$cookie->set();

Conclusion

CodeIgniter users should take immediate action to address this vulnerability. Upgrading to version 4.2.7 or later is the recommended solution. If upgrading is not immediately feasible, users can apply the provided workarounds to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for codeigniter →

FAQ