Description

In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-11-06T11:17:11.457Z",
  "pubdate": "2026-11-06T11:17:11.457Z",
  "executiveSummary": "A security vulnerability exists in JetBrains Ktor versions prior to 3.6.1 related to improper validation of the 'Domain' attribute within the client-side cookie storage mechanism.\nThe vulnerability is classified as a cookie injection flaw, which may allow malicious actors to manipulate or inject unauthorized cookies into the client storage.\nThis issue affects the Ktor HTTP client, potentially compromising the integrity of session management and cookie-based authentication mechanisms.\nAn attacker capable of influencing the server response or intercepting HTTP traffic could potentially bypass domain-scoping restrictions, leading to cross-site scripting (XSS) scenarios or unauthorized session data access.\nSuccessful exploitation requires the client to process maliciously crafted cookie headers that fail to adhere to expected domain-scoping rules.\nThe primary risk implications involve the potential for session hijacking, unauthorized data exfiltration, or the injection of persistent state-related payloads into the victim's local storage environment.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient enforcement of domain attribute validation logic within the Ktor HTTP client's cookie storage subsystem. When the Ktor client parses 'Set-Cookie' headers received from a remote server, it failed to verify that the 'Domain' attribute strictly adheres to the origin's scope.\nIn standard browser-like behavior, a domain attribute must be validated to ensure that a server is only permitted to set cookies for its own domain or a permissible sub-domain. By failing to perform this validation, the Ktor client's internal storage allows cookies to be associated with domains that the originating server should not influence.\nThe attack flow typically initiates when an attacker controls a malicious server or executes a man-in-the-middle (MITM) position. Upon receiving a request from a Ktor-based client, the attacker responds with a 'Set-Cookie' header containing a 'Domain' attribute that points to a target domain (e.g., a session-sensitive domain). Because the client-side storage lacks the necessary validation logic to verify this scope, it incorrectly persists the injected cookie.\nOnce stored, these malicious cookies are subsequently transmitted by the Ktor client in future requests to the improperly associated domain. This mechanism permits an attacker to perform cookie tossing, where they force the victim's client to transmit attacker-controlled values to a target service. If the target application relies on these cookies for authentication or CSRF tokens, the attacker may successfully perform session fixation, bypass CSRF protections, or induce application-level logic errors.\nThis vulnerability is restricted to versions of Ktor prior to 3.6.1. The flaw is inherent in the handling of HTTP state management within the client component. No specific authentication or privilege requirements are strictly necessary to trigger the injection, provided the client makes a request to the attacker-controlled endpoint. Network exposure is dependent on the client's connectivity to the adversarial infrastructure.\nThe post-exploitation impact includes the potential to deceive backend services into trusting malicious state information, potentially leading to unauthorized actions performed under the context of the user's session. The absence of domain attribute validation effectively neutralizes the security boundaries intended by the 'Domain' directive in the Set-Cookie specification, resulting in an inconsistent state across the client's cookie storage."
}