cve/2023/CVE-2023-46218.md

CVE-2023-46218

Description

This flaw allows a malicious HTTP server to set "super cookies" in curl thatare then passed back to more origins than what is otherwise allowed orpossible. This allows a site to set cookies that then would get sent todifferent and unrelated sites and domains.It could do this by exploiting a mixed case flaw in curl's function thatverifies a given cookie domain against the Public Suffix List (PSL). Forexample a cookie could be set with domain=co.UK when the URL used a lowercase hostname curl.co.uk, even though co.uk is listed as a PSL domain.

POC

Reference

No PoCs from references.

Github

• https://github.com/bartvoet/assignment-ehb-security-review-adamlenez
• https://github.com/fkie-cad/nvd-json-data-feeds
• https://github.com/testing-felickz/docker-scout-demo