CyberRota Analysis
AI-GeneratedThe CookieJar client middleware in Http4s versions prior to 0.23.35 and 1.0.0-M47 is vulnerable due to improper cookie domain and path matching, allowing cookies intended for legitimate domains to be sent to attacker-controlled hosts. This flaw can lead to session hijacking and unauthorized access to sensitive information. Developers and organizations using affected versions of Http4s should prioritize upgrading to the patched versions to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware uses unanchored substring checks instead of RFC 6265 domain and path matching when deciding whether to attach a stored cookie. A cookie for example.com can consequently be sent to an attacker-controlled hostname such as evilexample.com when an application using the same jar makes an attacker-influenced outbound request. This exposes session or authentication cookies and can enable hijacking of the application’s outbound sessions. This issue is fixed in versions 0.23.35 and 1.0.0-M47.