Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the guzzlehttp/guzzle library's handling of cookies within the CookieJar class. The analysis of the patch commit 7b68220d6543f6f80fe62e633361fc9d4ead14d4 reveals two primary vulnerable functions:
GuzzleHttp\Cookie\CookieJar::extractCookies: This function processes incoming Set-Cookie headers. Prior to the patch, it lacked checks for the number of cookies and their individual size. This allowed a malicious server to send an unbounded number of cookies in a response, causing the client to store excessive data in memory.
GuzzleHttp\Cookie\CookieJar::withCookieHeader: This function constructs the Cookie header for outgoing requests. Before the fix, it would aggregate all matching cookies from the jar into a single header. When combined with the extractCookies vulnerability, this could lead to the creation of an extremely large Cookie header. Such a header could exceed limits imposed by web servers, proxies, or other network intermediaries, causing requests to fail and resulting in a denial of service.
The root cause is the lack of resource allocation limits when handling untrusted server responses, specifically concerning cookies. An attacker could exploit this by setting a large number of cookies on a related domain (e.g., attacker.example.com setting cookies for example.com), which would then be sent to a victim service (e.g., service.example.com), potentially overwhelming it.
GuzzleHttp\Cookie\CookieJar::extractCookiessrc/Cookie/CookieJar.php
GuzzleHttp\Cookie\CookieJar::withCookieHeadersrc/Cookie/CookieJar.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| guzzlehttp/guzzle | composer | < 7.15.1 | 7.15.1 |