Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

NVD Description

When processing a `Set-Cookie` from a response, the `CookieJar` client middleware trusts the server-supplied `Domain` attribute verbatim, with no check that it domain-matches the host that sent the cookie (RFC6265 §5.3 step 6) and no public suffix check. A malicious or compromised server can therefore plant a cookie for any domain in the cookie jar, which is subsequently set on the client's next request to that victim domain, enabling session fixation or overwriting security-relevant cookies. ## Impact Session fixation and overwrite of security-relevant cookies for arbitrary domains contacted by the same wrapped client. ## Preconditions - Application uses the `CookieJar` client middleware. - Application contacts an attacker-controlled (or compromised) server using the same jar it uses for trusted hosts. ## Workarounds - Do not share a `CookieJar` across trusted and untrusted targets. ## Note This middleware still does not implement public suffix rejection.

Affected Packages (3)