Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware uses unanchored substring checks instead of RFC 6265 domain and path matching when deciding whether to attach a stored cookie. A cookie for example.com can consequently be sent to an attacker-controlled hostname such as evilexample.com when an application using the same jar makes an attacker-influenced outbound request. This exposes session or authentication cookies and can enable hijacking of the application’s outbound sessions. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

Affected: Maven: org.http4s:http4s-client_2.12, Maven: org.http4s:http4s-client_2.13, Maven: org.http4s:http4s-client_3

The `CookieJar` client middleware decides whether to attach a cookie to an outgoing request using an unanchored substring test on the host and path, instead of the domain match specified by RFC6265 5.1.3. A cookie stored for `example.com` is therefore sent to any host whose name merely contains `example.com` (e.g. `evilexample.com`), leaking potentially sensitive cookies to an attacker-chosen host.

## Impact

Disclosure of session and authentication cookies to an attacker-controlled host, enabling session hijack of the application's outbound calls.

## Preconditions

- Application uses the `CookieJar` client middleware. - Application can be induced to make an outbound request to a host controlled by the attacker, where the hostname contains the targeted domain as a substring.

## Workarounds

- Do not use the `CookieJar` with clients that fetch attacker-influenced URLs - Apply a separate `CookieJar` per trusted origin.