CVE-2024-2756 __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
Attackers can bypass __Host- and __Secure- cookie protections in PHP applications by setting standard insecure cookies, potentially leading to session hijacking or security control evasion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-2756?
CVE-2024-2756 is a medium-severity vulnerability in PHP, published on 29 Apr 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.
Weakness: CWE-20
Which versions are affected by CVE-2024-2756?
3 open source packages ship an affected version, including libphp, php and php-min.
| Package | Affected | Fixed in |
|---|---|---|
libphp Bitnami | All versions | 8.1.28, 8.2.18, 8.3.5 |
php Bitnami | All versions | 8.1.28, 8.2.18, 8.3.5 |
php-min Bitnami | All versions | 8.1.28, 8.2.18, 8.3.5 |
How do I fix CVE-2024-2756?
Upgrade libphp to a fixed version for your release line: 8.1.28, 8.2.18 or 8.3.5.
Is CVE-2024-2756 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-2756 exists.
Sources
Also known as AZL-40070, BELL-CVE-2024-2756, BIT-libphp-2024-2756, BIT-php-2024-2756, BIT-php-min-2024-2756, CLEANSTART-2026-QQ38336 and 7 more.