CVE-2023-46218

2023-12-0701:15:07

hackerone

web.nvd.nist.gov

188

cve-2023-46218

flaw

curl

http server

security issue

vulnerability

information security

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

30.9%

JSON

This flaw allows a malicious HTTP server to set “super cookies” in curl that
are then passed back to more origins than what is otherwise allowed or
possible. This allows a site to set cookies that then would get sent to
different and unrelated sites and domains.

It could do this by exploiting a mixed case flaw in curl’s function that
verifies a given cookie domain against the Public Suffix List (PSL). For
example a cookie could be set with domain=co.UK when the URL used a lower
case hostname curl.co.uk, even though co.uk is listed as a PSL domain.

Affected configurations

Nvd

Vulners

Node

haxxcurlRange7.46.0–8.4.0

Node

fedoraprojectfedoraMatch39

VendorProductVersionCPE
haxxcurlcpe:/a:haxx:curl::::

Vendor	Product	Version	CPE
haxx	curl		cpe:/a:haxx:curl::::

CNA Affected

[
  {
    "vendor": "curl",
    "product": "curl",
    "versions": [
      {
        "version": "8.4.0",
        "status": "affected",
        "lessThanOrEqual": "8.4.0",
        "versionType": "semver"
      },
      {
        "version": "7.46.0",
        "status": "unaffected",
        "lessThan": "7.46.0",
        "versionType": "semver"
      }
    ]
  }
]