Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in the tarteaucitron.cookie.purge function, which is responsible for deleting cookies. The analysis of the commit that patches the vulnerability clearly shows that the logic of this function was modified to add a security check. Before the fix, the function would delete any cookie whose name was passed as an argument, without any validation. The patch adds a verification step to ensure that the cookie belongs to a service managed by tarteaucitron.js before deleting it. The provided PoC demonstrates how an attacker can exploit this by tricking a user into clicking a crafted link that triggers the vulnerable function to delete an arbitrary cookie. Therefore, tarteaucitron.cookie.purge is the vulnerable function.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tarteaucitronjs | npm | < 1.33.0 | 1.33.0 |
