Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin

The CookieJar client middleware decides whether to attach a cookie to an outgoing request using an unanchored substring test on the host and path, instead of the domain match specified by RFC6265 5.1.3. A cookie stored for example.com is therefore sent to any host whose name merely contains example.com (e.g. evilexample.com), leaking potentially sensitive cookies to an attacker-chosen host.

Impact

Disclosure of session and authentication cookies to an attacker-controlled host, enabling session hijack of the application's outbound calls.

Preconditions

• Application uses the CookieJar client middleware.
• Application can be induced to make an outbound request to a host controlled by the attacker, where the hostname contains the targeted domain as a substring.

Workarounds

• Do not use the CookieJar with clients that fetch attacker-influenced URLs
• Apply a separate CookieJar per trusted origin.