Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin

NVD Description

The `CookieJar` client middleware decides whether to attach a cookie to an outgoing request using an unanchored substring test on the host and path, instead of the domain match specified by RFC6265 5.1.3. A cookie stored for `example.com` is therefore sent to any host whose name merely contains `example.com` (e.g. `evilexample.com`), leaking potentially sensitive cookies to an attacker-chosen host. ## Impact Disclosure of session and authentication cookies to an attacker-controlled host, enabling session hijack of the application's outbound calls. ## Preconditions - Application uses the `CookieJar` client middleware. - Application can be induced to make an outbound request to a host controlled by the attacker, where the hostname contains the targeted domain as a substring. ## Workarounds - Do not use the `CookieJar` with clients that fetch attacker-influenced URLs - Apply a separate `CookieJar` per trusted origin.

Affected Packages (3)