CVE-2016-8615

Vulnerability

A flaw in curl before version 7.51.0 allows cookie injection for arbitrary domains. The libcurl function that loads cookies into memory reads the cookie jar file line-by-line using fgets() into a fixed-size buffer. If a cookie line (name + value) is longer than the buffer, fgets() truncates the line. Crafted long cookie lines sent by a malicious HTTP server can therefore be stored and later partially read, potentially being treated as a valid cookie for a different domain [4]. The flaw affects curl versions 4.9 up to and including 7.50.3 [4].

Exploitation

An attacker must control an HTTP server that the victim's libcurl-based application will connect to, and the application must use CURLOPT_COOKIEFILE (or the -b command-line option) to read a cookie jar file that was written from a previous session. The attacker sends an HTTP response containing a cookie with an overly long name or value (exceeding the fixed buffer). This long cookie is stored in the cookie jar file. When the file is later read, fgets() truncates the line; with careful crafting, the truncated data is interpreted as a cookie for a different domain than the original server [4].

Impact

A successful injection allows an attacker to set cookies for arbitrary domains. This can lead to session fixation, cross-site request forgery, or other attacks that rely on cookies being associated with the wrong origin. The attacker does not gain code execution or direct access to the file system, but can manipulate cookie-based authentication or state in subsequent requests made by the vulnerable application [4].

Mitigation

The vulnerability is fixed in curl version 7.51.0, released on November 2, 2016 [4]. Users should upgrade curl and libcurl to 7.51.0 or later. Red Hat has backported fixes in RHSA-2018:2486 and RHSA-2018:3558 [1][2]. As a workaround, avoid using the CURLOPT_COOKIEFILE option with untrusted cookie jars. If patching is not immediately possible, do not reuse cookie files that may contain long cookie lines from malicious servers [4].