Platform
curl
Component
curl
Fixed in
7.51.1
CVE-2016-8615 is a vulnerability in curl versions 7.51.0 that allows malicious HTTP servers to inject arbitrary cookies into cookie jar files. This can lead to session hijacking and unauthorized access to sensitive data. The vulnerability stems from how curl handles cookie state when writing to and reading from cookie jar files. A fix is available in version 7.51.1.
An attacker can exploit this vulnerability by crafting a malicious HTTP response that includes specially crafted cookies. When curl writes this response to a cookie jar file, the attacker can later inject arbitrary cookies for any domain into the jar. Subsequently, when curl reads this cookie jar file and makes requests to other websites, it will unknowingly include the attacker's injected cookies. This can lead to session hijacking, where the attacker can impersonate a legitimate user, or to unauthorized access to sensitive data. The impact is particularly severe if the cookie jar file is shared across multiple applications or users.
CVE-2016-8615 was publicly disclosed on August 1, 2018. While no active exploitation campaigns have been definitively linked to this vulnerability, the potential for session hijacking makes it a valuable target for attackers. There are publicly available proof-of-concept exploits demonstrating the vulnerability. It is not currently listed on CISA KEV.
Exploit Status
CVSS Vector
The primary mitigation for CVE-2016-8615 is to upgrade to curl version 7.51.1 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as disabling cookie jar file usage or carefully validating the contents of cookie jar files before use. WAFs can be configured to inspect HTTP responses for suspicious cookie headers. Monitor curl logs for unusual cookie activity. After upgrading, confirm the fix by attempting to reproduce the vulnerability with a known malicious HTTP server and verifying that the injected cookies are not included in subsequent requests.
Update to version 7.51.1 or later to mitigate the vulnerability. This update corrects how curl handles cookies, preventing malicious servers from injecting arbitrary cookies into the cookie jar.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2016-8615 is a vulnerability in curl 7.51.0 that allows malicious servers to inject cookies into cookie jar files, potentially leading to session hijacking.
If you are using curl version 7.51.0 and rely on cookie jar files, you are potentially affected. Upgrade to 7.51.1 or later to mitigate the risk.
The recommended fix is to upgrade to curl version 7.51.1 or a later version. If upgrading is not possible, consider temporary workarounds like disabling cookie jar usage.
While no confirmed active exploitation campaigns are publicly known, the potential for session hijacking makes it a valuable target, and proof-of-concept exploits are available.
Refer to the curl security advisory for detailed information: https://curl.se/security/CVE-2016-8615.html
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.