Bypassing WAFs with the phantom $Version cookie
Summary: PortSwigger researcher Zak Fedotkin published research showing that legacy cookie-parsing features, including the RFC2109 $Version attribute, quoted cookie values, comma separators, and multiple Cookie headers, create parser discrepancies that can be abused to bypass web application firewalls. The post demonstrates that frameworks such as Spring Boot with Apache Tomcat 9.0.83 and Python's SimpleCookie handle these headers differently, and that AWS WAF signatures can be evaded using quoted strings and multiline Cookie header continuation.
What you should know: The same parser gaps that hide a payload from a WAF can also carry SQL injection and command injection separators like semicolons, commas, newlines, and backslashes past that WAF, so a signature your edge relies on may not be inspecting what your origin actually parses.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026