Vulnerability GHSA-grh8-3p95-f9rr

Medium Risk

3 hours ago

Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin

0.15.0 and 0.15.1 and 0.15.2 and 0.15.3 and 0.15.4 and 0.15.5 and 0.15.6 and 0.15.7 and 0.15.8 and 0.15.9 and 0.15.10 and 0.15.11 and 0.15.12 and 0.15.13 and 0.15.14 and 0.15.15 and 0.15.16 and 0.16.0 and 0.16.1 and 0.16.2 and 0.16.3 and 0.16.4 and 0.16.5 and 0.16.6 and 0.19.0

Summary

Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin

Details

The CookieJar client middleware decides whether to attach a cookie to an outgoing request using an unanchored substring test on the host and path, instead of the domain match specified by RFC6265 5.1.3. A cookie stored for example.com is therefore sent to any host whose name merely contains example.com (e.g. evilexample.com), leaking potentially sensitive cookies to an attacker-chosen host.

Impact

Disclosure of session and authentication cookies to an attacker-controlled host, enabling session hijack of the application's outbound calls.

Preconditions

Application uses the CookieJar client middleware.
Application can be induced to make an outbound request to a host controlled by the attacker, where the hostname contains the targeted domain as a substring.