CVE-2013-1944: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Published: 2013-04-29T22:55Z
Repository: https://github.com/bagder/curl
Language: C
Files changed: lib/cookie.c
Commit date: 2013-04-11 23:52:12 +0200
Commit message: cookie: fix tailmatching to prevent cross-domain leakage

Cookies set for 'example.com' could accidentaly also be sent by libcurl
to the 'bexample.com' (ie with a prefix to the first domain name).

This is a security vulnerabilty, CVE-2013-1944.

Bug: http://curl.haxx.se/docs/adv_20130412.html

Diff: diff --git a/lib/cookie.c b/lib/cookie.c
index 4b9ec0bdd..a67204e6e 100644
--- a/lib/cookie.c
+++ b/lib/cookie.c
@@ -116,19 +116,33 @@ static void freecookie(struct Cookie *co)
     free(co->version);
 
   free(co);
 }
 
-static bool tailmatch(const char *little, const char *bigone)
+static bool tailmatch(const char *cooke_domain, const char *hostname)
 {
-  size_t littlelen = strlen(little);
-  size_t biglen = strlen(bigone);
+  size_t cookie_domain_len = strlen(cooke_domain);
+  size_t hostname_len = strlen(hostname);
 
-  if(littlelen > biglen)
+  if(hostname_len < cookie_domain_len)
     return FALSE;
 
-  return Curl_raw_equal(little, bigone+biglen-littlelen) ? TRUE : FALSE;
+  if(!Curl_raw_equal(cooke_domain, hostname+hostname_len-cookie_domain_len))
+    return FALSE;
+
+  /* A lead char of cookie_domain is not '.'.
+     RFC6265 4.1.2.3. The Domain Attribute says:
+       For example, if the value of the Domain attribute is
+       "example.com", the user agent will include the cookie in the Cookie
+       header when making HTTP requests to example.com, www.example.com, and
+       www.corp.example.com.
+   */
+  if(hostname_len == cookie_domain_len)
+    return TRUE;
+  if('.' == *(hostname + hostname_len - cookie_domain_len - 1))
+    return TRUE;
+  return FALSE;
 }
 
 /*
  * Load cookies from all given cookie files (CURLOPT_COOKIEFILE).
  */

Vulnerable code: static bool tailmatch(const char *little, const char *bigone)
  size_t littlelen = strlen(little);
  size_t biglen = strlen(bigone);
  if(littlelen > biglen)
  return Curl_raw_equal(little, bigone+biglen-littlelen) ? TRUE : FALSE;
Fixed code: static bool tailmatch(const char *cooke_domain, const char *hostname)
  size_t cookie_domain_len = strlen(cooke_domain);
  size_t hostname_len = strlen(hostname);
  if(hostname_len < cookie_domain_len)
  if(!Curl_raw_equal(cooke_domain, hostname+hostname_len-cookie_domain_len))
    return FALSE;

  /* A lead char of cookie_domain is not '.'.
     RFC6265 4.1.2.3. The Domain Attribute says:
       For example, if the value of the Domain attribute is
       "example.com", the user agent will include the cookie in the Cookie
       header when making HTTP requests to example.com, www.example.com, and
       www.corp.example.com.
   */
  if(hostname_len == cookie_domain_len)
    return TRUE;
  if('.' == *(hostname + hostname_len - cookie_domain_len - 1))
    return TRUE;
  return FALSE;