CVE-2026-39963

### Summary The `serendipity_setCookie()` function uses `$_SERVER['HTTP_HOST']` without validation as the `domain` parameter of `setcookie()`. An attacker can force authentication cookies — including session tokens and auto-login tokens — to be scoped to an attacker-controlled domain, facilitating session hijacking. ### Details In `include/functions_config.inc.php:726`: ```php function serendipity_setCookie($name, $value, $securebyprot = true, ...) { $host = $_SERVER['HTTP_HOST']; // ← attacker-controlled, no validation if ($securebyprot) { if ($pos = strpos($host, ":")) { $host = substr($host, 0, $pos); // strips port only } } setcookie("serendipity[$name]", $value, [ 'domain' => $host, // ← poisoned domain 'httponly' => $httpOnly, 'samesite' => 'Strict' ]); } ``` This function is called during login with sensitive cookies: ```php // functions_config.inc.php:455-498 serendipity_setCookie('author_autologintoken', $rnd, true, false, true); serendipity_setCookie('author_username', $user); serendipity_setCookie('author_token', $hash); ``` If an attacker can influence the `Host` header at login time (e.g. via MITM, reverse proxy misconfiguration, or load balancer), authentication cookies are issued scoped to the attacker's domain instead of the legitimate one. ### PoC ```bash curl -v -X POST \ -H "Host: attacker.com" \ -d "serendipity[user]=admin&serendipity[pass]=admin" \ http://[TARGET]/serendipity_admin.php 2>&1 | grep -i "set-cookie" ``` Expected output: ```http Set-Cookie: serendipity[author_token]=; domain=attacker.com; HttpOnly ``` ### Impact - **Session fixation** — attacker pre-sets a cookie scoped to their domain, then tricks the victim into authenticating, inheriting the poisoned token - **Token leakage** — `author_autologintoken` scoped to wrong domain may be sent to attacker-controlled infrastructure - **Privilege escalation** — if admin logs in under a poisoned Host header, their admin token is compromised ### Suggested Fix Validate `HTTP_HOST` against the configured `$serendipity['url']` before use: ```php function serendipity_setCookie($name, $value, ...) { global $serendipity; $configured = parse_url($serendipity['url'], PHP_URL_HOST); $host = preg_replace('/:[0-9]+$/', '', $_SERVER['HTTP_HOST']); $host = ($host === $configured) ? $host : $configured; setcookie("serendipity[$name]", $value, [ 'domain' => $host, ... ]); } ```

### Summary The `serendipity_setCookie()` function uses `$_SERVER['HTTP_HOST']` without validation as the `domain` parameter of `setcookie()`. An attacker can force authentication cookies — including session tokens and auto-login tokens — to be scoped to an attacker-controlled domain, facilitating session hijacking. ### Details In `include/functions_config.inc.php:726`: ```php function serendipity_setCookie($name, $value, $securebyprot = true, ...) { $host = $_SERVER['HTTP_HOST']; // ← attacker-controlled, no validation if ($securebyprot) { if ($pos = strpos($host, ":")) { $host = substr($host, 0, $pos); // strips port only } } setcookie("serendipity[$name]", $value, [ 'domain' => $host, // ← poisoned domain 'httponly' => $httpOnly, 'samesite' => 'Strict' ]); } ``` This function is called during login with sensitive cookies: ```php // functions_config.inc.php:455-498 serendipity_setCookie('author_autologintoken', $rnd, true, false, true); serendipity_setCookie('author_username', $user); serendipity_setCookie('author_token', $hash); ``` If an attacker can influence the `Host` header at login time (e.g. via MITM, reverse proxy misconfiguration, or load balancer), authentication cookies are issued scoped to the attacker's domain instead of the legitimate one. ### PoC ```bash curl -v -X POST \ -H "Host: attacker.com" \ -d "serendipity[user]=admin&serendipity[pass]=admin" \ http://[TARGET]/serendipity_admin.php 2>&1 | grep -i "set-cookie" ``` Expected output: ```http Set-Cookie: serendipity[author_token]=; domain=attacker.com; HttpOnly ``` ### Impact - **Session fixation** — attacker pre-sets a cookie scoped to their domain, then tricks the victim into authenticating, inheriting the poisoned token - **Token leakage** — `author_autologintoken` scoped to wrong domain may be sent to attacker-controlled infrastructure - **Privilege escalation** — if admin logs in under a poisoned Host header, their admin token is compromised ### Suggested Fix Validate `HTTP_HOST` against the configured `$serendipity['url']` before use: ```php function serendipity_setCookie($name, $value, ...) { global $serendipity; $configured = parse_url($serendipity['url'], PHP_URL_HOST); $host = preg_replace('/:[0-9]+$/', '', $_SERVER['HTTP_HOST']); $host = ($host === $configured) ? $host : $configured; setcookie("serendipity[$name]", $value, [ 'domain' => $host, ... ]); } ```

Serendipity es un motor de weblogs impulsado por PHP. En las versiones 2.6-beta2 y anteriores, la función serendipity_setCookie() en include/functions_config.inc.php utiliza $_SERVER[’HTTP_HOST’] sin validación como parámetro de dominio de setcookie(). Un atacante que puede influir en el encabezado Host en el momento del inicio de sesión, como a través de MitM, una mala configuración de proxy inverso o manipulación del balanceador de carga, puede forzar que las cookies de autenticación, incluidos los tokens de sesión y los tokens de inicio de sesión automático, se limiten a un dominio controlado por el atacante. Esto permite la fijación de sesión, la fuga de tokens a infraestructura controlada por el atacante y la escalada de privilegios si un administrador inicia sesión bajo un encabezado Host envenenado. Este problema ha sido solucionado en la versión 2.6.0.