Cookie Forgery via Missing Signature

auth · medium · +40 XP

// what is Cookie Forgery via Missing Signature?

Deserialization & cookie forgery — when a session is stored client-side as a serialized blob, you have to verify its integrity or attackers will tamper with it. base64(JSON) without HMAC = trivially forgeable. Pickle without integrity = RCE. Java/PHP deserialization = the classic 'gadget chain' RCE primitive.

// how attackers detect it

[01]Base64-decode the session cookie. Is it human-readable JSON? Can you tamper a field and re-encode?
[02]Look for pickle.loads, unserialize (PHP), ObjectInputStream (Java) on user-supplied data — instant RCE risk.
[03]Try changing "role":"user" → "role":"admin" and re-sending.

// how defenders prevent it

✓Sign and verify every client-side blob with HMAC-SHA256 (server-side secret).
✓Prefer server-side sessions — store a random session ID client-side, real data in Redis/DB.
✓Never pickle.loads(user_input) — use JSON. For PHP, never unserialize on input. For Java, see SerialKiller.

// real-world incidents

CVE-2017-9805

Apache Struts2 deserialization → Equifax breach

147M customer records — single deserialization bug.

CVE-2021-44228

Log4Shell — JNDI deserialization vector

Worst CVE of 2021. Internet-wide RCE.

// hands-on tips for this lab

›Server appends .hexsig but never verifies it. Tamper the JSON + base64 it. The trailing sig can be anything — .deadbeef.

was this lesson helpful?

Cross-Site Request Forgery

// end of web

10 of 10 · web