CVE-2023-23934: Werkzeug - Cookie Prefix Vulnerability
Summary
CVE-2023-23934: Werkzeug is a comprehensive WSGI web application library. Affects python-werkzeug across 3 version ranges.
< 1.0.1+dfsg1-2+deb11u1
< 22a254fca2ad0130adbbcbd11d3de51bcb04a08b
< cf275f42acad1b5950c50ffe8ef58fe62cdce028
Fixed in 1.0.1+dfsg1-2+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Werkzeug is a comprehensive WSGI web application library. It provides a set of utilities for building web applications in Python. Werkzeug allows developers to handle HTTP requests and responses, routing, and other web-related tasks. It is widely used in various Python web frameworks and applications.
Vulnerability Detail
The vulnerability in Werkzeug, identified as CVE-2023-23934, involves the parsing of cookies with a prefix of '='. Certain browsers allow the creation of 'nameless' cookies that appear as '=value' instead of 'key=value'. This vulnerability can be exploited by a compromised application on an adjacent subdomain to set a cookie with a prefix of '__Host-' for another subdomain. Werkzeug versions prior to 2.2.3 incorrectly parse such cookies, resulting in the valid cookie key being shadowed by the bad cookie value. This issue can be triggered when a vulnerable or malicious subdomain sets a cookie using a vulnerable browser, and a Werkzeug application running on an adjacent subdomain encounters the bad cookie value.
How To Fix
Minimum fixed version
1.0.1+dfsg1-2+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-werkzeugTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of Werkzeug to mitigate the risk.
Conclusion
The vulnerability in Werkzeug allows for the manipulation of cookies with a prefix of '='. This can lead to potential security risks and unauthorized access to sensitive information. It is crucial to update to Werkzeug version 2.2.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-werkzeug →
FAQ
Werkzeug is a WSGI web application library for Python. It provides utilities for handling HTTP requests and responses, routing, and other web-related tasks.
This vulnerability allows a compromised application on an adjacent subdomain to set a cookie with a prefix of '__Host-' for another subdomain. This can lead to potential security issues and unauthorized access to sensitive information.
Versions of Werkzeug prior to 2.2.3 are affected by this vulnerability. It is recommended to upgrade to version 2.2.3 or later.
No, there are no known workarounds for this vulnerability. Updating to the fixed version of Werkzeug is the recommended solution.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for python-werkzeug.
