GHSA-chp3-j5qr-2vfr: Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()
Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie() allow semicolon delimiters that serializeCookie() writes verbatim into Set-Cookie headers. A caller that supplies attacker-controlled values can append cookie attributes, including a broader Domain or, when the caller has not set those options itself, SameSite=None or Max-Age. Encoded cookie values and CR or LF characters remain unaffected. This can widen a cookie's scope or add otherwise-unset cookie attributes. This issue is fixed in @effect/platform 0.97.1 and effect 4.0.0-beta.103.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@effect/platformto a version that resolves this vulnerability.Fixed in 0.97.1 - Upgrade
Upgrade
effectto a version that resolves this vulnerability.Fixed in 4.0.0-beta.103
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using affected versions of @effect/platform or effect are exposed only where they pass attacker-controlled data into the name, domain, or path fields of makeCookie(). Cookie values that are encoded, and CR or LF injection attempts, are not affected by this issue.
What could an attacker change through a vulnerable makeCookie() call?
A semicolon in an attacker-controlled name, domain, or path can add cookie attributes to the serialized Set-Cookie header. This can broaden the cookie Domain or, if the application did not already set them, add attributes such as SameSite=None or Max-Age.
Are default cookie settings enough to prevent exploitation?
The issue depends on attacker control of the name, domain, or path inputs to makeCookie(), not on a stated default configuration. Setting cookie options yourself can prevent an attacker from adding SameSite=None or Max-Age where those options are already present, but does not address semicolon handling in the affected fields.
What should be done if upgrading cannot happen immediately?
Do not pass untrusted values as the cookie name, domain, or path, and reject or sanitize semicolon delimiters in those fields before calling makeCookie(). Upgrade to @effect/platform 0.97.1 or later, or effect 4.0.0-beta.103 or later, when possible.