GHSA-grh8-3p95-f9rr: Medium severity maven/org.http4s:http4s-client_3 vulnerability
The CookieJar client middleware decides whether to attach a cookie to an outgoing request using an unanchored substring test on the host and path, instead of the domain match specified by RFC6265 5.1.3. A cookie stored for example.com is therefore sent to any host whose name merely contains example.com (e.g. evilexample.com), leaking potentially sensitive cookies to an attacker-chosen host.
Impact
Disclosure of session and authentication cookies to an attacker-controlled host, enabling session hijack of the application's outbound calls.
Preconditions
- Application uses the CookieJar client middleware. - Application can be induced to make an outbound request to a host controlled by the attacker, where the hostname contains the targeted domain as a substring.
Workarounds
- Do not use the CookieJar with clients that fetch attacker-influenced URLs - Apply a separate CookieJar per trusted origin.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.http4s:http4s-client_3to a version that resolves this vulnerability.Fixed in 1.0.0-M47 - Upgrade
Upgrade
maven/org.http4s:http4s-client_2.13to a version that resolves this vulnerability.Fixed in 1.0.0-M47 - Upgrade
Upgrade
maven/org.http4s:http4s-client_3to a version that resolves this vulnerability.Fixed in 0.23.35 - Upgrade
Upgrade
maven/org.http4s:http4s-client_2.13to a version that resolves this vulnerability.Fixed in 0.23.35 - Upgrade
Upgrade
maven/org.http4s:http4s-client_2.12to a version that resolves this vulnerability.Fixed in 0.23.35 - Configuration
Apply a separate `CookieJar` per trusted origin so cookies are not reused across untrusted hosts.
CookieJar client middleware cookie jar usage = separate per trusted origin - Configuration
Do not use the `CookieJar` middleware with clients that fetch attacker-influenced URLs.
CookieJar client middleware CookieJar assignment = do not use with attacker-influenced URL fetching clients
Event History
Frequently Asked Questions
Which applications are realistically exposed to cookie leakage?
Applications using the CookieJar client middleware are exposed when they make outbound requests to attacker-influenced URLs. The attacker-controlled hostname must contain the domain associated with a stored cookie as a substring, such as evilexample.com for a cookie scoped to example.com.
What can an attacker gain if exploitation succeeds?
The affected client can send session or authentication cookies to the attacker-controlled host. Those cookies may enable session hijacking for the application's outbound calls.
Are applications that only call fixed trusted origins affected?
The described exploitation requires the application to be induced to request an attacker-controlled host. Clients limited to trusted origins do not meet that precondition.
What can be done if the affected middleware cannot immediately be removed or updated?
Do not use CookieJar with clients that fetch attacker-influenced URLs. Where cookies are needed, use a separate CookieJar for each trusted origin.