CVE-2023-23934: Wrkzeug's incorrect parsing of nameless cookies leads to __Host- cookies bypass

Vulnerability summary

CVE-2023-23934 is a low (CVSS 3.5) Improper Input Validation vulnerability in pallets werkzeug. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 43.3% of scored vulnerabilities.

Timeline

1. 14-02-2023
   PublishedVulnerability first disclosed.
2. 10-03-2025
   Last modifiedVulnerability information updated.

Description

Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in Werkzeug 2.2.3.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.