CVE-2022-39284 Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued in Codeigniter4
CodeIgniter4 fails to apply Secure or HttpOnly flags to cookies, exposing them to scripts and allowing potential session hijacking or data theft.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-39284?
CVE-2022-39284 is a low-severity vulnerability in CodeIgniter4, published on 6 Oct 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\Cookie` is not reflected in `set_cookie()` or `Response::setCookie()`. As a result cookie values are erroneously exposed to scripts. It should be noted that this vulnerability does not affect session cookies. Users are advised to upgrade to v4.2.7 or later. Users unable to upgrade are advised to manually construct their cookies either by setting the options in code or by constructing Cookie objects. Examples of each workaround are available in the linked GHSA.
Which versions are affected by CVE-2022-39284?
3 open source packages ship an affected version, including codeigniter4/framework and codeigniter. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
codeigniter4/framework Packagist | All versions | 4.2.7 |
codeigniter4/framework Packagist | All versions | 4.2.7 |
codeigniter Bitnami | From 4.0.0 | 4.2.7 |
Products include Codeigniter Codeigniter.
How do I fix CVE-2022-39284?
Upgrade codeigniter4/framework to 4.2.7 or later.
Is CVE-2022-39284 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-39284 exists.
Other vulnerabilities in CodeIgniter4
Sources
Also known as BIT-codeigniter-2022-39284, GHSA-745p-r637-7vvp.