Collected research

Cookie Bugs - Smuggling & Injection

Ankur Sundara · arxenix's blog · 5 May 2023

Java and Python web servers parse the Cookie header differently from browsers. Several still honour RFC2965 quoted strings, so a double quote in one cookie value swallows the cookies after it and can leak an HttpOnly session id to an XSS. Others begin a new cookie on a space, comma or closing quote, letting one controllable value inject spoofed cookies and defeat cookie-based CSRF checks.

Record

Researcher

Ankur Sundara

Published by

arxenix's blog

Date

5 May 2023

Topic

Identity

In the archive

• Collected in the 2023 research round

Related sources

• GHSA-p26g-97m4-6q7c Advisory

Tags

• cookie
• parser-differential
• smuggling
• injection
• csrf
• cve
• java
• python
• http
• owasp-a01-2021
• owasp-a03-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Ankur Sundara, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.