6

In my web application I take the GET paramater x and I store it in a cookie after URL-encoding it (so there is no HTTP response splitting). Some people say that this can be abused to cause DOS, but I can't find any explanaition in the Internet. Is my web application vulnerable to any attack vector?

  • As long as theses parameters aren't criticals or secrets for your application I don't think your application is vulnerable. – Core972 Apr 6 '18 at 8:34
0

It depends, there isn't really enough information to make an informed decision.

The DOS issue in the past was usually described as allowing attackers to overflow cookie space limits for a domain, which can have interesting security ramifications. This is much less of an issue now, though.

There can be larger contextual and system evolution concerns. I saw a case once where an application blindly wrote cookies in this way as a cheap data sharing scheme with related applications on other subdomains. Then the suite was whitelabeled, so the root domain the application was running under was no longer the provider but the client's. Then suddenly other applications under the client domain could have their cookies rewritten. That's fun.

Generally speaking, plenty of applications do just this, and it's fine, but always consider ways to restrict and constrain what gets written (does it have to just be any data, or is there some structure that can be imposed upon it), and always consider the data untrustworthy without validation (e.g. consider adding a signature to ensure what is read is what was written.)

  • 1
    After further digging, the max size of an HTTP request for most web servers in 8KB, since the browser send the cookies in every request, it's possible to cause a single-user DOS if the attacker managed to set that size of cookies in the victim session. – Reda LM Apr 26 '18 at 16:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.