Cookie Domain Flaw in Curl Affects Multiple Platforms

CVE-2023-46218

What is CVE-2023-46218?

This security vulnerability in curl allows a malicious HTTP server to exploit a flaw in how cookie domains are verified. Specifically, it permits the setting of 'super cookies' that may be sent back to a wider array of unrelated sites and domains than originally intended. The root cause stems from a mixed case flaw in curl's domain verification process with the Public Suffix List (PSL), allowing, for instance, a cookie with 'domain=co.UK' to be set when accessing a URL with a lower-case hostname such as 'curl.co.uk', even though 'co.uk' is recognized as a PSL domain. This behavior significantly undermines cookie security and user privacy across the web.

References