GHSA-c6v4-qj2h-f748: Tornado before 6.6 Cookie Attribute Injection via set_cookie max_age
Tornado before 6.6 does not validate the maxage argument of RequestHandler.setcookie (also called by setsignedcookie, setsecurecookie, and clearcookie), allowing injection of additional Set-Cookie attributes. When an application passes attacker-influenced input as maxage, an attacker can embed attributes such as Domain, Path, or Secure to widen the cookie's scope to parent paths or other subdomains.
Event History
Frequently Asked Questions
What application behavior makes this issue exploitable?
An application must pass attacker-influenced input to the max_age argument of RequestHandler.set_cookie or a method that calls it, including set_signed_cookie, set_secure_cookie, or clear_cookie. The supplied value can then inject additional Set-Cookie attributes.
Which cookie properties can an attacker alter through this issue?
An attacker can embed attributes including Domain, Path, or Secure. This can widen a cookie's scope to parent paths or other subdomains.
Are applications affected by default?
The issue requires an application-specific unsafe use of max_age with attacker-influenced input. The provided information does not indicate that ordinary fixed max_age values are exploitable.