The CookieJar client middleware decides whether to attach a cookie to an outgoing request using an unanchored substring test on the host and path, instead of the domain match specified by RFC6265 5.1.3. A cookie stored for example.com is therefore sent to any host whose name merely contains example.com (e.g. evilexample.com), leaking potentially sensitive cookies to an attacker-chosen host.
Impact
Disclosure of session and authentication cookies to an attacker-controlled host, enabling session hijack of the application's outbound calls.
Preconditions
- Application uses the
CookieJar client middleware.
- Application can be induced to make an outbound request to a host controlled by the attacker, where the hostname contains the targeted domain as a substring.
Workarounds
- Do not use the
CookieJar with clients that fetch attacker-influenced URLs
- Apply a separate
CookieJar per trusted origin.
References
rossabaker Analyst
ERobertGII Finder
samspills Remediation reviewer
The
CookieJarclient middleware decides whether to attach a cookie to an outgoing request using an unanchored substring test on the host and path, instead of the domain match specified by RFC6265 5.1.3. A cookie stored forexample.comis therefore sent to any host whose name merely containsexample.com(e.g.evilexample.com), leaking potentially sensitive cookies to an attacker-chosen host.Impact
Disclosure of session and authentication cookies to an attacker-controlled host, enabling session hijack of the application's outbound calls.
Preconditions
CookieJarclient middleware.Workarounds
CookieJarwith clients that fetch attacker-influenced URLsCookieJarper trusted origin.References