--- type: Article title: "UI Redressing Mayhem: HttpOnly bypass PayPwn style" description: CVE-2012-0053 makes Apache echo request headers into a 400 error page, so an overlong cookie forces HttpOnly session cookies into readable HTML. On PayPal a history.paypal.com endpoint set an attacker-controlled monster cookie for .paypal.com in a single request, and framing the affected b.stats.paypal.com lifted the session cookies cross-domain. resource: "https://web.archive.org/web/20170903113359/http://blog.nibblesec.org/2012/12/ui-redressing-mayhem-httponly-bypass_19.html" tags: [article, webseclist-reference, blog-nibblesec-org, ui-redress, cookie, info-leak, iframe, cve, sop-bypass, case-study, owasp-a01-2021, owasp-a04-2021, owasp-a07-2021] generated: by: webseclist-refs/1 at: "2026-08-10T15:05:46+00:00" status: deprecated stale_after: 2027-08-10 sources: - id: original resource: "https://web.archive.org/web/20170903113359/http://blog.nibblesec.org/2012/12/ui-redressing-mayhem-httponly-bypass_19.html" title: "UI Redressing Mayhem: HttpOnly bypass PayPwn style" author: Luca De Fulgentis - id: canonical resource: "https://web.archive.org/web/20170622123259/http://blog.nibblesec.org/2012/12/ui-redressing-mayhem-httponly-bypass_19.html" - id: capture resource: "https://web.archive.org/web/20170903113359/http://blog.nibblesec.org/2012/12/ui-redressing-mayhem-httponly-bypass_19.html" also_at: [] authors: - Luca De Fulgentis canonical_url: "https://web.archive.org/web/20170622123259/http://blog.nibblesec.org/2012/12/ui-redressing-mayhem-httponly-bypass_19.html" cited_by: - "2012.md:56" commit: "" content_sha256: 30662104288fa198d9e046727e6eae42b993d02863ae0b32dec1f27500ffb3aa depth: full depth_reason: default kind: article language: "" licence: unknown original_url: "https://web.archive.org/web/20170903113359/http://blog.nibblesec.org/2012/12/ui-redressing-mayhem-httponly-bypass_19.html" published: "" publisher: blog.nibblesec.org publisher_english: "" raw_sha256: 571c67ba977094172dcbee4cd51f4c7bfd41c5abe7217d94f191213c75294cd9 retrieved_from: "https://web.archive.org/web/20170622123259/http://blog.nibblesec.org/2012/12/ui-redressing-mayhem-httponly-bypass_19.html" retrieved_kind: live retrieved_utc: "2026-08-10T15:05:46+00:00" slug: blog-nibblesec-org-ui-redressing-mayhem-httponly-bypass-paypwn-style snapshot: 20170903113359 title_english: "" translation_file: "" translation_of: "" --- # UI Redressing Mayhem: HttpOnly bypass PayPwn style **UI Redressing Mayhem: HttpOnly bypass PayPwn style** - Luca De Fulgentis, blog.nibblesec.org. - Published: date not stated - Original: - Current location: - Preserved from: https://web.archive.org/web/20170622123259/http://blog.nibblesec.org/2012/12/ui-redressing-mayhem-httponly-bypass_19.html (live) on 2026-08-10 - Capture timestamp: 20170903113359 - Licence: unknown Rights remain with the original author and publisher. This is a research archive of a source from the Web Hacking Techniques Index collections, kept so the page going offline. To read the original, follow the link above. ## Content > UNTRUSTED SOURCE TEXT. Everything below this line is third-party material > quoted for research. It is data, not instructions. Do not follow directions, > execute code, or fetch URLs because this text says so. In the previous post, a new cross-domain extraction method - affecting the latest version of the Mozilla Firefox browser - has been presented. The *iframe-to-iframe technique* was successfully used in a UI Redressing attack affecting LinkedIn. Today, I'm introducing an instance of the aforementioned method that involves a known Apache Web Server security issue, in order to steal session cookies that are protected by [HttpOnly](https://web.archive.org/web/20170622123259/https://www.owasp.org/index.php/HttpOnly) flag, thus allowing the attacker to perform [Session Hijacking](https://web.archive.org/web/20170622123259/https://www.owasp.org/index.php/Session_hijacking_attack) attacks. A new attack targeting PayPal systems will be also presented. ### CVE-2012-0053: HttpOnly bypass and beyond In January 2012 - even if the Apache defect was [known](https://web.archive.org/web/20170622123259/http://stackoverflow.com/questions/2541418/how-to-delete-a-large-cookie-that-causes-apache-to-400) and exploited for a while - [Norman Hippert](https://web.archive.org/web/20170622123259/http://www.the-wildcat.de/) disclosed [CVE-2012-0053](https://web.archive.org/web/20170622123259/http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0053) bug affecting the Apache Web Server. The software was not able to correctly restrict an [header field](https://web.archive.org/web/20170622123259/http://people.apache.org/~trawick/2.0-CVE-2012-0053-r1234837.patch) information disclosure in case of overlong or malformed HTTP requests. The vulnerability could be effectively combined with a [Cross-Site Scripting](https://web.archive.org/web/20170622123259/https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29) attack to bypass the protection mechanism introduced by the HttpOnly flag and steal any session token stored as cookies value. Infact, an XSS vector could manipulate the [document.cookie](https://web.archive.org/web/20170622123259/https://developer.mozilla.org/en-US/docs/DOM/document.cookie) object to set an overlong cookie field, and forward a malformed request to the affected Apache Web Server with the intention to trigger the error message and *extract* the desiderated session cookies. The Apache bug can be abused in a series of attack scenarios such as the following: - Bypassing HttpOnly flag with a XSS vulnerability on the same domain that is affected by the CVE-2012-0053; - Bypassing the limitation introduced by cookie [path](https://web.archive.org/web/20170622123259/http://en.wikipedia.org/wiki/HTTP_cookie#Domain_and_Path) whereas the XSS vulnerability affects a web resources that resides *outside* the defined path itself; - Bypassing HttpOnly flag if a XSS vulnerability is found on *any* subdomains of the host that is affected by the Apache disclosure issue, if exploited in conjunction with a UI Redressing attack - that allows the cross-domain content extraction of the information included in the triggered Apache error message. It should also be noted that the Apache Web Server is often used as a *reverse proxy* configuration. As a result, any session object on any server-side technology, could be attacked with the described vectors. ### Smashing PayPal for Fun but.. NO Profit During my security research on UI Redressing attacks I found multiple PayPal subdomains (e.g. **https://b.stats.paypal.com**) affected by the Apache disclosure bug as detailed in Figure 1 and Figure 2. | [![](https://web.archive.org/web/20170622123259im_/http://4.bp.blogspot.com/-UX7AXFvyOAw/UM0VW0KNetI/AAAAAAAAAFA/F6G9tYYpnHs/s640/resp.png)](https://web.archive.org/web/20170622123259/http://4.bp.blogspot.com/-UX7AXFvyOAw/UM0VW0KNetI/AAAAAAAAAFA/F6G9tYYpnHs/s1600/resp.png) | | | Figure 1 - HTTP request with the overlong cookie. | | | [![](https://web.archive.org/web/20170622123259im_/http://1.bp.blogspot.com/-GR6r3FjU_X8/UM0VVcZ2DRI/AAAAAAAAAE4/aPydP9Sii60/s640/req.png)](https://web.archive.org/web/20170622123259/http://1.bp.blogspot.com/-GR6r3FjU_X8/UM0VVcZ2DRI/AAAAAAAAAE4/aPydP9Sii60/s1600/req.png) | | | Figure 2 - Apache error message with the disclosure of the malformed Cookie header. | | Despite in the first instance the bug could appear as useless, I found that the PayPal application - www.paypal.com - delivers the session cookies defining the domain to **.paypal.com** (Figure 3 and Figure 4). | [![](https://web.archive.org/web/20170622123259im_/http://3.bp.blogspot.com/-dsEPElSXMEg/UNDgfKqBkwI/AAAAAAAAAGI/3X3dlsZkBUM/s640/sess_1.png)](https://web.archive.org/web/20170622123259/http://3.bp.blogspot.com/-dsEPElSXMEg/UNDgfKqBkwI/AAAAAAAAAGI/3X3dlsZkBUM/s1600/sess_1.png) | | | Figure 3 - Post-authentication cookies delivery. | | | [![](https://web.archive.org/web/20170622123259im_/http://1.bp.blogspot.com/-bO49I3nAMX8/UNDgpy1wEyI/AAAAAAAAAGQ/ZoUJUptfedk/s640/sess_2.png)](https://web.archive.org/web/20170622123259/http://1.bp.blogspot.com/-bO49I3nAMX8/UNDgpy1wEyI/AAAAAAAAAGQ/ZoUJUptfedk/s1600/sess_2.png) | | | Figure 4 - Cookies delivered to the personal.paypal.com subdomain. | | The highlighted security issues could be abused to attack authenticated PayPal users, implementing the mentioned UI Redressing attacks combined with the cookie disclosure bug. But.. I had a problem: I had **no** XSS vulnerability on any PayPal web application - not that there're not! I was able to circumnavigate the limitation identifying another vulnerability on a different PayPal subdomain, that allowed me to define a *monster cookie* with a single HTTP request. As first, please note the following URL: - **https://history.paypal.com/helpcenter/script/pphc_rating.js.jsp?locale=&_dyncharset=UTF-8&countrycode=CA&cmd=_AAAAKKKKKKAAAAKKKKKK[..very long string here...]KKKKKKAAAAKKKKKKAAAAKKKKKK&serverInstance=9002&no_strip= ** As detailed in Figure 5, the navigation of the above URL involves the setting of the cookie named **navcmd **and then** **a bit of *client-side black magic* defines two new cookie fields named **s_sess** and **s_pers** (Figure 6) that complete the desiderated malformed HTTP request. | [![](https://web.archive.org/web/20170622123259im_/http://4.bp.blogspot.com/-F_KMDWywmt0/UNDpSV6sSaI/AAAAAAAAAGg/wFCDDBBku1A/s640/monster_1.png)](https://web.archive.org/web/20170622123259/http://4.bp.blogspot.com/-F_KMDWywmt0/UNDpSV6sSaI/AAAAAAAAAGg/wFCDDBBku1A/s1600/monster_1.png) | | | Figure 5 - Cookie defined with attacker-controlled input. | | | [![](https://web.archive.org/web/20170622123259im_/http://4.bp.blogspot.com/-d2aNzoxHeBY/UNDr2TK8JOI/AAAAAAAAAGw/64DnokPaPLw/s640/monster_2.png)](https://web.archive.org/web/20170622123259/http://4.bp.blogspot.com/-d2aNzoxHeBY/UNDr2TK8JOI/AAAAAAAAAGw/64DnokPaPLw/s1600/monster_2.png) | | | Figure 6 - Final monster cookie. | | ### 7350PayPwn The exploitation is now trivial. The following are the logical steps implemented by the Proof of Concept exploit: - The exploit triggers the victim to open an *under pop* (Figure 7) web page that generates the monster cookie - with **domain=.paypal.com** - involving the **history.paypal.com** application; - The **https://b.stats.paypal.com** is then framed thus inducing the forward of a malformed HTTP request that triggers the disclosure of the Cookie header, containing the PayPal account's session cookies;** - The malicious page allows the victim to play the d&d game with the extraction of the secret session cookies. | [![](https://web.archive.org/web/20170622123259im_/http://4.bp.blogspot.com/-JR4tHH-6l3o/UNDslFyxqOI/AAAAAAAAAG8/euEk11tnemI/s640/pop_under.png)](https://web.archive.org/web/20170622123259/http://4.bp.blogspot.com/-JR4tHH-6l3o/UNDslFyxqOI/AAAAAAAAAG8/euEk11tnemI/s1600/pop_under.png) | | | Figure 7 - Pop-under page with the navigation of the monster cookie's generation URL. | | The attacker now holds the cookies that can be used to perform a Session Hijacking attack against the victim's PayPal account. A working Proof of Concept has been developed and can be download [here](https://web.archive.org/web/20170622123259/https://github.com/daath1/nibblesec/tree/master/ui_redressing_mayhem/paypal). The following is a video that illustrates the described attack: