GHSA-7w2g-9mf9-324m: Rust/hurl vulnerability
The Bug
Hurl <= 8.0.1 lets you define cookies two ways in a .hurl file:
1. As a raw Cookie: header in the [Header]/headers area 2. In a dedicated [Cookies] section (parsed into RequestSpec.cookies)
When following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug.
Hurl file that leaks cookies:
hurl GET http://localhost:8000/follow-redirect-basic-auth?changehost=true [Cookies] fruit: lemon HTTP 200
Hurl file that doesn't leak cookie:
hurl GET http://localhost:8000/follow-redirect-basic-auth?changehost=true Cookie: fruit=lemon HTTP 200
Patch
With Hurl <= 8.0.1, user can use Cookie header instead of the dedicated [Cookies] section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
hurlto a version that resolves this vulnerability.Fixed in 8.0.1
Event History
Frequently Asked Questions
Who is exposed to this credential leak?
Users of Hurl 8.0.1 or earlier are exposed when a .hurl file uses the dedicated [Cookies] section and follows a redirect to a different host. The cookies defined in that section can be sent to the redirected host.
What must occur for exploitation?
A request must follow a cross-host redirect, and the Hurl file must define cookies through [Cookies]. Cookies supplied as a raw Cookie header are stripped during such redirects.
Is there a workaround if updating is not immediately possible?
Use a raw Cookie header in the headers area instead of the dedicated [Cookies] section. Hurl strips the Cookie header when redirecting to a different host.