Cookie Jar Deletion in curl HTTP Client

Executive Summary

This vulnerability allows a remote HTTP server to set a cookie that curl accepts and stores in a Netscape cookie jar. When curl tries to reload the cookie jar in later uses with the same paths for --cookie and --cookie-jar, it fails to connect and triggers a cleanup. This cleanup incorrectly replaces the entire cookie jar with an empty file, deleting cookies for unrelated domains.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system is running a vulnerable version of curl (8.18.0 to 8.22.0). Run 'curl --version' to verify the installed version. If the version falls within this range, the system is potentially affected.

Useful 0 Not Useful 0

Impact Analysis

If you use curl versions 8.18.0 through 8.22.0 with cookie jars, an attacker could trick curl into deleting cookies for unrelated domains by sending a specially crafted cookie. This could disrupt sessions or log users out of unrelated services that rely on cookies stored in the jar.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade curl to version 8.23.0 or later. If upgrading is not possible, avoid using cookies with curl by not using the --cookie or --cookie-jar options. Alternatively, apply the official patch provided by the curl project.

Useful 0 Not Useful 0