Cookie manipulation (reflected DOM-based)
Summary: Reflected DOM-based vulnerabilities occur when data from a request is echoed into the immediate response inside a part of the DOM that a client-side script then processes unsafely, and DOM-based cookie manipulation occurs when a script writes controllable data into a cookie's value. An attacker can construct a URL that, when visited by another user, sets an arbitrary cookie value, with impact depending on the cookie's role - unintended actions if it controls behavior such as a 'production' versus 'demo' mode, or session fixation and hijacking if it tracks the user's session.
Bottom line: If the manipulated cookie carries a session token, the attacker sets it to a valid token they already obtained and hijacks the session during the victim's next interaction with the application.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026