Junglewise Threat Intelligence

CVE-2023-46218: curl cookie mixed case PSL bypass

CVE-2023-46218 · Severity: medium · CVSS 6.5 · Published 2023-12-07

Technologies: Fedoraproject Fedora, Curl. Vendors: Fedoraproject, Haxx.

Executive brief

A vulnerability in the curl data transfer tool allows malicious websites to set "super cookies" that are shared with unrelated domains. This could allow an attacker to track users or interfere with sessions on different websites. The issue stems from how curl handles uppercase and lowercase letters when checking domain names against a security list.

Technical details

A flaw exists in curl's cookie domain verification logic when comparing domains against the Public Suffix List (PSL). The function fails to properly normalize case sensitivity, allowing a server to set a cookie for a domain like 'co.UK' even if 'co.uk' is a protected public suffix. This bypass enables the creation of "super cookies" that are subsequently sent to unrelated origins. The vulnerability affects curl versions 7.46.0 through 8.4.0 when built with PSL support. A fix was introduced in version 8.5.0 by converting both strings to lowercase before performing the PSL check.

Affected products

  • curl curl 7.46.0 to 8.4.0

Timeline

  • 2023-10-16: disclosed: Issue reported to the curl project
  • 2023-11-28: other: Contacted distributions via openwall
  • 2023-12-06: patched: curl 8.5.0 released with fix
  • 2023-12-06: advisory: Project curl security advisory published

References

Related threats