Cookie Jar Deletion in curl HTTP Client

Executive Summary

This vulnerability allows a remote HTTP server to set a cookie that curl accepts and stores in a Netscape cookie jar. When curl tries to reload the cookie jar in later uses with the same paths for --cookie and --cookie-jar, it fails to connect and triggers a cleanup. This cleanup incorrectly replaces the entire cookie jar with an empty file, deleting cookies for unrelated domains.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system is running a vulnerable version of curl (8.18.0 to 8.22.0). Run 'curl --version' to verify the installed version. If the version falls within this range, the system is potentially affected.

Useful 0 Not Useful 0

Impact Analysis

If you use curl versions 8.18.0 through 8.22.0 with cookie jars, an attacker could trick curl into deleting cookies for unrelated domains by sending a specially crafted cookie. This could disrupt sessions or log users out of unrelated services that rely on cookies stored in the jar.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It primarily causes cookie deletion in curl's cookie jar, which may impact session management but does not involve unauthorized data access, disclosure, or processing violations typically addressed by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade curl to version 8.23.0 or later. If upgrading is not possible, avoid using cookies with curl by not using the --cookie or --cookie-jar options. Alternatively, apply the official patch provided by the curl project.

Useful 0 Not Useful 0