Vulnerability GHSA-wv64-j4fq-5f9x

Medium Risk

3 hours ago

Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

0.15.0 and 0.15.1 and 0.15.2 and 0.15.3 and 0.15.4 and 0.15.5 and 0.15.6 and 0.15.7 and 0.15.8 and 0.15.9 and 0.15.10 and 0.15.11 and 0.15.12 and 0.15.13 and 0.15.14 and 0.15.15 and 0.15.16 and 0.16.0 and 0.16.1 and 0.16.2 and 0.16.3 and 0.16.4 and 0.16.5 and 0.16.6 and 0.19.0

Summary

Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

Details

When processing a Set-Cookie from a response, the CookieJar client middleware trusts the server-supplied Domain attribute verbatim, with no check that it domain-matches the host that sent the cookie (RFC6265 §5.3 step 6) and no public suffix check. A malicious or compromised server can therefore plant a cookie for any domain in the cookie jar, which is subsequently set on the client's next request to that victim domain, enabling session fixation or overwriting security-relevant cookies.

Impact

Session fixation and overwrite of security-relevant cookies for arbitrary domains contacted by the same wrapped client.

Preconditions

Application uses the CookieJar client middleware.
Application contacts an attacker-controlled (or compromised) server using the same jar it uses for trusted hosts.