CyberRota Analysis
AI-GeneratedHurl versions 8.0.1 and earlier are vulnerable due to improper handling of redirects, which allows an attacker to exploit this flaw by capturing authentication or session cookies when a redirect changes the host. This could lead to unauthorized access to user sessions or sensitive information. Organizations using Hurl for HTTP request testing should prioritize upgrading to version 8.1.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries RequestSpec.cookies created from the dedicated [Cookies] section into the redirected request. An attacker-controlled redirect can therefore receive authentication or session cookies that should remain scoped to the original host. Cookies supplied through a raw Cookie header are stripped and are not affected by this specific path. This issue is reported as fixed in version 8.1.0.