CVE-2023-46218: Haxx Curl Information Disclosure Flaw

CVE-2023-46218 Overview

CVE-2023-46218 is a cookie injection vulnerability in curl that allows malicious HTTP servers to set "super cookies" that are passed back to more origins than normally permitted. This flaw enables a site to set cookies that would then be sent to different and unrelated sites and domains, effectively bypassing cookie security boundaries.

The vulnerability exploits a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example, a cookie could be set with domain=co.UK when the URL used a lowercase hostname curl.co.uk, even though co.uk is listed as a PSL domain. This case sensitivity issue allows attackers to circumvent the PSL protections designed to prevent such broad cookie scoping.

Critical Impact

Malicious servers can set cookies with overly broad domain scope, enabling cross-site tracking, session hijacking, and potential credential theft across unrelated websites sharing the same top-level domain suffix.

Affected Products

• haxx curl (multiple versions)
• fedoraproject fedora 39
• Debian Linux (see DSA-5587)

Discovery Timeline

• 2023-12-07 - CVE CVE-2023-46218 published to NVD
• 2025-06-30 - Last updated in NVD database

Technical Details for CVE-2023-46218

Vulnerability Analysis

This vulnerability stems from improper case handling during Public Suffix List (PSL) validation in curl's cookie processing logic. The PSL is a critical security mechanism that prevents websites from setting cookies on public suffixes like .com, .co.uk, or other shared domain registries. When curl receives a Set-Cookie header, it should validate that the cookie domain doesn't match a PSL entry to prevent "super cookies" that could track users across unrelated websites.

The flaw allows an attacker-controlled HTTP server to bypass this protection by using mixed-case domain values in the Set-Cookie header. Since the PSL comparison function failed to perform case-insensitive matching, a domain like co.UK (uppercase) would not match the lowercase co.uk entry in the PSL, allowing the cookie to be set despite the security restriction.

Root Cause

The root cause is a case sensitivity issue (CWE-178: Improper Handling of Case Sensitivity) in curl's PSL domain validation function. The function performs a direct string comparison between the cookie domain and PSL entries without normalizing the case of both strings. Since domain names are case-insensitive according to DNS specifications but the PSL check was case-sensitive, attackers could exploit this mismatch to set cookies with broader scope than intended.

Attack Vector

The attack can be executed remotely over the network without requiring authentication or user interaction. An attacker would need to control or compromise an HTTP server that a victim's curl-based application connects to. The attack flow is as follows:

1. Victim's application using curl connects to attacker-controlled server
2. Server responds with a Set-Cookie header using a mixed-case domain (e.g., domain=co.UK)
3. curl's PSL validation fails to match the mixed-case domain against the lowercase PSL entry
4. The "super cookie" is stored and subsequently sent to all sites under that domain suffix
5. Attacker can harvest cookies from other sites the victim visits under the same suffix

This vulnerability affects applications that rely on curl's cookie handling, including command-line curl usage with cookie jars and applications using libcurl for HTTP requests.

Detection Methods for CVE-2023-46218

Indicators of Compromise

• Unusual cookies with overly broad domain scopes in curl cookie jars or application cookie stores
• HTTP responses containing Set-Cookie headers with mixed-case domain attributes targeting public suffixes
• Unexpected cookie data being sent to multiple unrelated domains during curl requests
• Log entries showing cookies being transmitted to domains that don't match the original cookie source

Detection Strategies

• Monitor HTTP traffic for Set-Cookie headers with mixed-case domain attributes matching known PSL entries
• Implement network-level inspection rules to flag cookies with suspiciously broad domain scopes
• Review application logs for curl-based requests that exhibit abnormal cookie behavior
• Deploy endpoint detection to identify vulnerable curl versions in use across the environment

Monitoring Recommendations

• Enable verbose logging in curl-based applications to capture full HTTP headers including Set-Cookie directives
• Configure web proxies to alert on Set-Cookie headers with domain attributes matching public suffixes in any case combination
• Implement periodic vulnerability scanning to identify systems running affected curl versions
• Monitor for anomalous cross-domain cookie sharing patterns in network traffic analysis tools

How to Mitigate CVE-2023-46218

Immediate Actions Required

• Update curl to a patched version as specified in the CURL CVE-2023-46218 Documentation
• Review and clear existing cookie jars that may contain malicious super cookies
• Implement application-level cookie validation as an additional security layer
• Consider disabling cookie handling in curl for applications where cookies are not required

Patch Information

Security patches addressing this vulnerability have been released by curl and multiple Linux distributions. Organizations should consult the following resources for version-specific patch information:

• CURL CVE-2023-46218 Documentation - Official curl security advisory with fixed versions
• Debian Security Advisory DSA-5587 - Debian package updates
• Fedora Package Announcements - Fedora updates
• NetApp Security Advisory NTAP-20240125-0007 - NetApp product updates

Workarounds

• Disable cookie handling entirely using --no-cookies or -b "" when cookie functionality is not required
• Implement application-level cookie domain validation with proper case-insensitive PSL checking before processing
• Use network-level filtering to strip or reject Set-Cookie headers with mixed-case domain attributes
• Consider running curl with restricted network access to limit exposure to potentially malicious servers

# Disable cookie handling in curl commands
curl --no-cookies https://example.com

# Clear existing cookie jar to remove potentially malicious cookies
rm ~/.curl_cookies

# Use explicit cookie scope restrictions in applications
curl -b "" -c "" https://example.com