Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, identified as GHSA-wm3w-8rrp-j577, lies in how Guzzle's cookie handling mechanism processes cookies that are set without a Domain attribute. According to RFC 6265, such cookies should be 'host-only' and sent only to the exact host that set them. However, Guzzle's CookieJar::extractCookies function would incorrectly assign the request's host as the cookie's domain, effectively turning it into a domain-scoped cookie. This meant that the cookie would be sent to subdomains as well, which is a security risk as it could leak sensitive information like session tokens to less trusted subdomains.\n\nThe patch addresses this by introducing a HostOnly flag in the SetCookie class. The CookieJar::extractCookies function was modified to set this flag to true when a cookie is received without a Domain attribute. Subsequently, the SetCookie::matchesDomain function was updated to enforce an exact domain match for cookies with the HostOnly flag set. The persistent cookie jars, FileCookieJar and SessionCookieJar, were also updated to save and load this new HostOnly flag, ensuring that the correct cookie scope is maintained across sessions.
GuzzleHttp\Cookie\CookieJar::extractCookiessrc/Cookie/CookieJar.php
GuzzleHttp\Cookie\SetCookie::matchesDomainsrc/Cookie/SetCookie.php
GuzzleHttp\Cookie\FileCookieJar::loadsrc/Cookie/FileCookieJar.php
GuzzleHttp\Cookie\SessionCookieJar::loadsrc/Cookie/SessionCookieJar.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| guzzlehttp/guzzle | composer | < 7.15.1 |