Listen to this Post
The CVE-2026-35536 patch introduced a validation loop that rejects control characters ([\x00-\x20\x3b\x7f]) in cookie attribute values【0†L1-L2】. However, this validation was applied exclusively to the hardcoded lowercase keyword arguments: name, domain, path, and samesite【0†L1-L2】. The vulnerability persists because the deprecated `kwargs` path remains active and writes attacker-supplied attribute values directly into the `Morsel` object without any validation【0†L2-L3】. The `Morsel.__setitem__` method is case-insensitive, meaning a capitalized keyword argument such as Domain=, Path=, SameSite=, or `Max-Age=` routes to the same reserved attribute while completely bypassing the validation loop【0†L3-L5】. This oversight re-opens the ;-delimited attribute injection vector that CVE-2026-35536 was supposed to close【0†L5】.
For example, an attacker can call self.set_cookie("sid", "abc", Domain="evil.com; Secure; SameSite=None")【0†L6】. This produces a `Set-Cookie` header: sid=abc; Domain=evil.com; Secure; SameSite=None; Path=/【0†L7】. In contrast, using the canonical lowercase named argument is still blocked: `self.set_cookie(“sid”, “abc”, domain=”evil.com; Secure”)` raises http.cookies.CookieError【0†L8】. The regression test added with the patch, SetCookieForbiddenCharHandler, only exercises the four named parameters and never tests the `kwargs` path【0†L10-L11】. Consequently, the gap is not covered by regression tests【0†L11】.
The affected code resides in `tornado/web.py` within RequestHandler.set_cookie【0†L13】. The validation loop covers only the lowercase named arguments, while the trailing `if kwargs:` loop executes `morsel
= v` with no character validation【0†L13-L14】. To reproduce, a `GET /upper` request using the `Domain=` kwarg emits a `Set-Cookie` header with the injected attributes【0†L16】, whereas `GET /lower` using the lowercase `domain=` returns a <code>CookieError</code>【0†L16-L17】. The impact is the injection of independent cookie attributes, allowing an attacker to force or drop <code>Secure</code>, <code>HttpOnly</code>, or `SameSite` flags, and rebind `Domain` or <code>Path</code>【0†L19-L20】. This is the same impact that CVE-2026-35536 was meant to close, now accessible via the sibling path the patch missed【0†L20】. The vulnerability is conditional on the application using a capitalized or legacy keyword argument【0†L20-L21】. The suggested remediation is to apply the same `[\x00-\x20\x3b\x7f]` validation to every entry in the `kwargs` loop after normalizing the key case, or to remove the deprecated `kwargs` path entirely, and to add a regression test for capitalized kwargs【0†L23-L25】. <h2 style="color: blue;">DailyCVE Form:</h2> Platform: Tornado Version: Affected versions with CVE-2026-35536 patch Vulnerability: Cookie Attribute Injection Bypass Severity: Critical date: 2026-09-01 <h2 style="color: blue;">Prediction: 2026-09-15</h2> <h2 style="color: blue;">What Undercode Say:</h2> [bash] Check if Tornado server is vulnerable by sending a request with capitalized Domain= kwarg curl -i "http://target.com/upper" Expected vulnerable response: Set-Cookie: c_upper=v; Domain=evil.com; Secure; SameSite=None; Path=/
Python script to test vulnerability
import requests
url = "http://target.com/upper"
response = requests.get(url)
print(response.headers.get('Set-Cookie'))
Output should show injected attributes if vulnerable
Exploit: (Educational Purposes!)
Exploit payload to inject Secure and SameSite=None flags via capitalized Domain= kwarg
self.set_cookie("session", "malicious", Domain="attacker.com; Secure; SameSite=None")
Resulting Set-Cookie: session=malicious; Domain=attacker.com; Secure; SameSite=None; Path=/
Crafted HTTP request to exploit the vulnerability GET /upper HTTP/1.1 Host: target.com The server will generate Set-Cookie with injected attributes
Protection:
- Apply the same `[\x00-\x20\x3b\x7f]` validation to every entry in the `kwargs` loop after normalizing the key case【0†L23-L24】.
- Remove the deprecated `kwargs` path from
RequestHandler.set_cookie【0†L24】. - Add a regression test specifically for capitalized kwargs to ensure the fix is covered【0†L25】.
- Upgrade to the patched version of Tornado once available.
Impact:
- Injection of arbitrary cookie attributes, allowing attackers to force or drop
Secure,HttpOnly, or `SameSite` flags【0†L19-L20】. - Rebinding of `Domain` or `Path` attributes, potentially leading to session fixation or cross-site scripting (XSS)【0†L20】.
- Bypass of the original CVE-2026-35536 patch, re-opening the same attack vector【0†L20】.
- Conditional on the application using a capitalized or legacy keyword argument in `set_cookie` calls【0†L20-L21】.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
