When processing a Set-Cookie from a response, the CookieJar client middleware trusts the server-supplied Domain attribute verbatim, with no check that it domain-matches the host that sent the cookie (RFC6265 §5.3 step 6) and no public suffix check. A malicious or compromised server can therefore plant a cookie for any domain in the cookie jar, which is subsequently set on the client's next request to that victim domain, enabling session fixation or overwriting security-relevant cookies.
Impact
Session fixation and overwrite of security-relevant cookies for arbitrary domains contacted by the same wrapped client.
Preconditions
- Application uses the
CookieJar client middleware.
- Application contacts an attacker-controlled (or compromised) server using the same jar it uses for trusted hosts.
Workarounds
- Do not share a
CookieJar across trusted and untrusted targets.
Note
This middleware still does not implement public suffix rejection.
References
rossabaker Analyst
samspills Remediation reviewer
morgen-peschke Remediation reviewer
When processing a
Set-Cookiefrom a response, theCookieJarclient middleware trusts the server-suppliedDomainattribute verbatim, with no check that it domain-matches the host that sent the cookie (RFC6265 §5.3 step 6) and no public suffix check. A malicious or compromised server can therefore plant a cookie for any domain in the cookie jar, which is subsequently set on the client's next request to that victim domain, enabling session fixation or overwriting security-relevant cookies.Impact
Session fixation and overwrite of security-relevant cookies for arbitrary domains contacted by the same wrapped client.
Preconditions
CookieJarclient middleware.Workarounds
CookieJaracross trusted and untrusted targets.Note
This middleware still does not implement public suffix rejection.
References