CVE-2012-0053

published 2012-01-28

CVE-2012-0053: protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error…

Priority P3 44 medium 4.3 CVSS 2.0

AV N AC M Au N C P I N A N

EXPLOIT

protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.

Affected

15 ranges

Vendor	Product	Version range	Fixed in
apache	http_server	>= 2.0.0 < 2.0.65	2.0.65
apache	http_server	>= 2.2.0 < 2.2.22	2.2.22
debian	apache2	< apache2 2.2.22-1 (bookworm)	apache2 2.2.22-1 (bookworm)
debian	debian_linux	—	—
debian	debian_linux	—	—
debian	debian_linux	—	—
opensuse	opensuse	—	—
redhat	enterprise_linux_desktop	—	—
redhat	enterprise_linux_eus	—	—
redhat	enterprise_linux_server	—	—
redhat	enterprise_linux_workstation	—	—
redhat	jboss_enterprise_web_server	—	—
redhat	storage	—	—
suse	linux_enterprise_server	—	—
suse	linux_enterprise_software_development_kit	—	—

Detection & IOCs extracted from sources · hover to see the quote

path protocol.c↗

command Cookie: <oversized header exceeding LimitRequestFieldSize>↗

• → Monitor for HTTP 400 Bad Request responses that contain 'Cookie:' header values in the response body — this indicates the server is leaking HTTPOnly cookie contents via the default error document. ↗
• → Detect exploitation attempts by looking for HTTP requests with abnormally long or malformed headers (exceeding LimitRequestFieldSize) that trigger 400 responses, especially when Cookie headers are present. ↗
• → Detect JavaScript-based exploitation: look for client-side scripts issuing XHR GET requests to '/' and parsing the response body for 'Cookie:' strings, consistent with the PoC exploit technique. ↗
• → Detect exploit PoC pattern: scripts setting large numbers of cookies (named xss0, xss1, etc.) to inflate Cookie header size beyond LimitRequestFieldSize, then stripping them from the 400 response to isolate victim cookies. ↗
• → Flag Apache httpd versions 2.2.0 through 2.2.21 (inclusive) as vulnerable; fixed in 2.2.22. Also note Apache 2.0.x is affected despite the CVE description scope. ↗
• → Note that a header line lacking a ':' separator (missing name/value delimiter) also triggers the vulnerable 400 error path and can be used as an attack vector. ↗

• · This vulnerability is not standalone — it requires a pre-existing XSS flaw in a web application on the same server to be exploitable; it allows injected JavaScript to escalate access to HTTPOnly cookies. ↗
• · Most browsers limit cookies to 4KB, so the exploit requires setting multiple cookies to overflow the Cookie header past LimitRequestFieldSize. ↗

CVSS provenance

nvd v2.0 4.3 MEDIUM AV:N/AC:M/Au:N/C:P/I:N/A:N

osv 4.3 MEDIUM

vendor_ubuntu 4.4 MEDIUM

vendor_debian 4.3 LOW

vendor_redhat 4.3 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.