CVE-2014-3620

Vulnerability

CVE-2014-3620 is a vulnerability in cURL and libcurl versions 7.31.0 through 7.37.1 (inclusive). The cookie parser in these versions lacks Public Suffix List awareness and incorrectly rejects cookies for top-level domains (TLDs) when the host name is provided with a trailing dot, or accepts cookies for bare TLDs in other cases [3]. This bypasses the intended Same Origin Policy restriction, allowing a cookie set for one TLD to be sent to another unrelated site under the same TLD.

Exploitation

An attacker can exploit this by crafting a response that sets a cookie with a domain attribute of a bare TLD (e.g., .com) or by using a URL with a trailing dot TLD. No authentication or user interaction beyond visiting a specially crafted HTTP(S) response is required. The cookie engine must be opted-in by the application (not enabled by default in libcurl) [3]. The attacker does not need a man-in-the-middle position; any site that can set cookies via libcurl can trigger the issue.

Impact

A successful attack leads to information disclosure: the attacker can set a cookie that will be sent to multiple, separate domains under the same TLD. This violates the Same Origin Policy and may expose session tokens, preferences, or other sensitive data to unintended servers, potentially enabling session hijacking or cross-site scripting-like attacks [3]. The severity is rated High.

Mitigation

The fix was released in libcurl 7.38.0, which rejects cookies set for bare TLDs [3]. Users should upgrade to libcurl 7.38.0 or later. For applications that cannot be upgraded, disabling cookie support is recommended. Apple included a fix in OS X Yosemite v10.10.5 Security Update 2015-006 [1]. No workaround beyond these patches is available.