Summary
A cookie-handling flaw in cpp-httplib before 0.51.0 can preserve cookies when a client follows certain cross-origin HTTP redirects. If an attacker controls the redirect response or can observe traffic from a non-HTTPS origin, session cookies intended for the original host may be disclosed to the redirect target.
A cookie-handling flaw in cpp-httplib before 0.51.0 can preserve cookies when a client follows certain cross-origin HTTP redirects. If an attacker controls the redirect response or can observe traffic from a non-HTTPS origin, session cookies intended for the original host may be disclosed to the redirect target.
Affected context
The issue occurs in cpp-httplib clients that follow cross-origin 301, 302, 307, or 308 redirects. The redirect-handling logic removes Host, Proxy-Authorization, and Authorization headers but retains Cookie headers supplied directly or through default_headers_. The risk depends on whether an untrusted redirect target can be introduced or network traffic from a non-HTTPS origin can be observed.
The issue occurs in cpp-httplib clients that follow cross-origin 301, 302, 307, or 308 redirects. The redirect-handling logic removes Host, Proxy-Authorization, and Authorization headers but retains Cookie headers supplied directly or through default_headers_. The risk depends on whether an untrusted redirect target can be introduced or network traffic from a non-HTTPS origin can be observed.
Exploit preconditions
- Attack surface: HTTP or HTTPS client redirect handling
- Required access: Ability to cause or control a redirect response, or observe traffic from a non-HTTPS origin
- Trigger point: Following a cross-origin 301, 302, 307, or 308 redirect
- Required data: Cookies associated with the original request, including cookies configured through default_headers_
- Why exploitation is possible: The request is copied for the redirect while sensitive Cookie headers remain attached after other origin-bound headers are removed
- Attack surface: HTTP or HTTPS client redirect handling
- Required access: Ability to cause or control a redirect response, or observe traffic from a non-HTTPS origin
- Trigger point: Following a cross-origin 301, 302, 307, or 308 redirect
- Required data: Cookies associated with the original request, including cookies configured through default_headers_
- Why exploitation is possible: The request is copied for the redirect while sensitive Cookie headers remain attached after other origin-bound headers are removed
Why this happens
The underlying bug is incomplete sanitization of security-sensitive request headers during cross-origin redirect processing. Although several authentication and routing headers are removed, Cookie headers survive the copied-request path for 301, 302, 307, and 308 responses. This maps to CWE-522: Insufficiently Protected Credentials, because session credentials can be transmitted to an unintended recipient when origin boundaries are not enforced consistently.
The underlying bug is incomplete sanitization of security-sensitive request headers during cross-origin redirect processing. Although several authentication and routing headers are removed, Cookie headers survive the copied-request path for 301, 302, 307, and 308 responses. This maps to CWE-522: Insufficiently Protected Credentials, because session credentials can be transmitted to an unintended recipient when origin boundaries are not enforced consistently.
Potential impact
- Session cookies may be disclosed to an attacker-controlled redirect destination
- Authenticated sessions could be hijacked
- Users may experience unauthorized account activity
- Sensitive application data could be accessed through stolen session credentials
- Exposure may extend to multiple clients or users if shared default headers are configured
- Session cookies may be disclosed to an attacker-controlled redirect destination
- Authenticated sessions could be hijacked
- Users may experience unauthorized account activity
- Sensitive application data could be accessed through stolen session credentials
- Exposure may extend to multiple clients or users if shared default headers are configured
General mitigation guidance
Mitigation generally focuses on preventing credential-bearing headers from crossing origin boundaries.
Common defensive patterns include:
- Remove Cookie and other session-bearing headers before following cross-origin redirects
- Reconstruct redirected requests using an explicit allowlist of headers
- Treat redirect destinations as untrusted unless they match an approved origin policy
- Prefer HTTPS for every request and validate redirect schemes and destinations
- Avoid placing broadly scoped credentials in shared default headers
- Limit session cookie scope, lifetime, and privileges where practical
- Use redirect policies that require explicit application approval for cross-origin transitions
Mitigation generally focuses on preventing credential-bearing headers from crossing origin boundaries.
Common defensive patterns include:
- Remove Cookie and other session-bearing headers before following cross-origin redirects
- Reconstruct redirected requests using an explicit allowlist of headers
- Treat redirect destinations as untrusted unless they match an approved origin policy
- Prefer HTTPS for every request and validate redirect schemes and destinations
- Avoid placing broadly scoped credentials in shared default headers
- Limit session cookie scope, lifetime, and privileges where practical
- Use redirect policies that require explicit application approval for cross-origin transitions
How teams detect issues like this
Organizations can detect this class of issue through:
- Static analysis and code review checks for copied requests that retain Cookie or authorization headers
- Tests covering every redirect status supported by the client, including cross-origin destinations
- Integration tests that verify sensitive headers are absent after redirect processing
- Policy checks requiring explicit origin validation before forwarding credentials
- Network monitoring for session cookies appearing in requests to unexpected hosts
- Automated security review tools that flag credential propagation across trust boundaries
Organizations can detect this class of issue through:
- Static analysis and code review checks for copied requests that retain Cookie or authorization headers
- Tests covering every redirect status supported by the client, including cross-origin destinations
- Integration tests that verify sensitive headers are absent after redirect processing
- Policy checks requiring explicit origin validation before forwarding credentials
- Network monitoring for session cookies appearing in requests to unexpected hosts
- Automated security review tools that flag credential propagation across trust boundaries
