HTTP Requests with X-Vercel-Set-Bypass-Cookie Header, (Tue, Apr 28th)
Source SANS ISC Handlers Diary
Description
This weekend, we saw a few requests to our honeypot that included an "X-Vercel-Set-Bypass-Cookie" header. A sample request:
Impact
The impact is currently theoretical and limited to the potential misuse of a legitimate bypass feature intended for testing. If abused, it could allow an attacker to bypass certain deployment protections or security controls temporarily. However, no known exploits or confirmed vulnerabilities have been reported. The undocumented header value could potentially relax cookie security policies, but no direct evidence of data exposure or compromise is available.
Defensive guidance
Organizations using Vercel should ensure that bypass headers and cookies are not exposed or accepted in production environments unintentionally. Monitoring for unusual use of such headers and restricting their acceptance to trusted sources or environments is recommended. Patch status is not applicable; check Vercel's official documentation for updates on deployment protection features.
Summary
The threat involves HTTP requests containing the "X-Vercel-Set-Bypass-Cookie" header, which is linked to a Vercel feature that sets a cookie to maintain a protection bypass state. This feature is designed to facilitate testing by disabling certain security protections temporarily. The header value observed in the wild includes an undocumented option "samesite-none-secure," which may indicate attempts to weaken cookie security attributes. The requests were sent via an open proxy, likely to obscure the attacker's origin. There is no evidence of active exploitation or vulnerability in Vercel's platform based on the available information.
References
Community reviews
Related threats
- php2shell one week later: Why one exploit doesn’t work everywhereHighVulnerability
- ZDI-26-839: MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability
- ZDI-26-843: MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability
- ZDI-26-845: MLflow Statsmodels _load_model Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability
- Open-source tool for unpacking stripped Android native (.so) malware: static RegisterNatives recovery, ARM64 OLLVM (BR X8) deobfuscation, and Dobby anti-Frida tracingTool