Examples / Report #2212193 Saved analysis

CVE-2023-46218: cookie mixed case PSL bypass

curl · 2023-10-1612.5s analysis · $0.010 in model calls

What the report claims

libcurl fails to normalize hostname and cookie_domain in psl_is_cookie_domain_acceptable, allowing uppercase domains to bypass PSL checks and set supercookies.

Compare with curl's recorded outcome

Known vulnerability

A real vulnerability: CVE-2023-46218 cookie mixed case PSL bypass

Shown for comparison after analysis. The pipeline did not see this label.

ProveIt's finding

Needs human review

The available evidence does not settle the report. A maintainer should investigate.

Why this finding?

No curl source code was provided for the target revision (0b6d9ac8d9e1), so the central claim about missing normalization before calling psl_is_cookie_domain_acceptable cannot be verified.
Deterministic checks confirm the relevant symbols exist but not their usage.
The libpsl documentation URL cited by the reporter was not fetched; external sources returned unrelated content.
The report provides concrete reproduction steps and the flaw, if real, would be a security issue (supercookie protection bypass). A human needs to examine the actual curl source at the revision to decide.

What still needs checking

curl source code showing the call to psl_is_cookie_domain_acceptable and the handling of hostname/cookie_domain parameters at revision 0b6d9ac8d9e1
The libpsl documentation for psl_is_cookie_domain_acceptable and psl_str_to_utf8lower

How this analysis ran 5 claims · 0 citations verified

Checked against curl master on 2023-10-16 (0b6d9ac8d9e1). Dev evaluation split. Citation verification checks that a referenced line was in the evidence; it does not prove the model interpreted it correctly.

1 · Grounding

grounded

no model · 5 references checked out, 0 did not

2 · Claims

NVIDIA-Nemotron-3-Nano-30B-A3B

5 claims · 1676 tokens · $0.0002

3 · Evidence

0 code snippets

real curl source at 0b6d9ac8d9e1 · 3 docs via Tavily

4 · Judgment

Nemotron-3-Ultra-550b-a55b

6163 tokens · 7.6s · $0.0094

5 · Receipts

0 of 0 citations verified

every citation must point at code the judge was shown

Review a draft reply to the reporter

Edit and verify before sending.

Thank you for the detailed report and reproduction steps. We need to examine the curl source code at the revision you tested (0b6d9ac8d9e1) to verify whether hostname and cookie_domain are normalized before being passed to psl_is_cookie_domain_acceptable. Could you point to the specific file and function where this call occurs, or provide the relevant code snippet? The libpsl documentation you cite was not accessible in our fetch; if you have a copy of the relevant section, that would also help.

Inspect all claims and source code 5 claims · 0 code excerpts

Report claims

C1flaw not verifiable

libcurl fails to normalize hostname and cookie_domain parameters passed to psl_is_cookie_domain_acceptable

Read the reasoning

No curl source code was provided for the revision checked (0b6d9ac8d9e1). The deterministic checks only confirm that the symbols 'hostname', 'cookie_domain', and 'psl_is_cookie_domain_acceptable' exist in the codebase, but do not show how they are used or whether normalization occurs before the call. Without the calling code, I cannot verify whether libcurl fails to normalize these parameters.

C2location not verifiable

in psl_is_cookie_domain_acceptable function

Read the reasoning

The location claim depends on the same missing code. The function 'psl_is_cookie_domain_acceptable' exists per deterministic checks, but its implementation and call sites were not provided.

C3trigger not verifiable

malicious site can set a super cookie if the victim requests the url with hostname with any upper case characters in the domain part of the hostname

Read the reasoning

The trigger claim describes an attack path that depends on the missing normalization. Without seeing the code that calls psl_is_cookie_domain_acceptable and handles the cookie domain, I cannot confirm or contradict the described bypass.

C4impact not verifiable

bypassing supercookie protection

Read the reasoning

Impact claim depends on the validity of C1-C3. If the bypass exists, the impact (bypassing supercookie protection) would follow, but the root cause is not verifiable from provided materials.

C5reproduction not verifiable

echo -ne "HTTP/1.1 200 OK\r\nSet-Cookie: super=oops; domain=co.UK\r\nContent-Length: 0\r\n" | nc -v -l -q 1 -p 8888; curl -v -c c.txt --resolve test.co.uk:8888:testserverip http://test.co.UK:8888; nc -v -l -p 7777; curl -v -b c.txt --resolve other.co.uk:7777:testserverip http://other.co.uk:7777

Read the reasoning

Reproduction steps are provided but cannot be validated against the code because the relevant curl source code is missing. The steps reference 'nc' and 'curl' command-line tools, not curl source code.

What the report says about other projects

not addressed Use helper function psl_str_to_utf8lower() for normalization of hostname and cookie_domain

Read the original report

Full report on HackerOne ↗

## Summary: libcurl fails to normalize the `hostname` and `cookie_domain` parameters passed to `psl_is_cookie_domain_acceptable` function. As a result a malicious site can set a super cookie if the victim requests the url with hostname with any upper case characters in the domain part of the hostname. libpsl `psl_is_cookie_domain_acceptable` documentation https://rockdaboot.github.io/libpsl/libpsl-Public-Suffix-List-functions.html#psl-is-cookie-domain-acceptable says the following: ``` Use helper function psl_str_to_utf8lower() for normalization of hostname and cookie_domain . ``` This is not done correctly and hence domains with uppercase characters will bypass the PSL check. Note that curl itself will later ignore the cookie domain capitalization and will match even lowercase hostname with the stored supercookie's mixed case domain. It's also worth noting that the request `Host` header will reveal the mixed case used, which will allow the attacker to prepare the correct `Set-Cookie` domain for the attack. ## Steps To Reproduce: 1. `echo -ne "HTTP/1.1 200 OK\r\nSet-Cookie: super=oops; domain=co.UK\r\nContent-Length: 0\r\n" | nc -v -l -q 1 -p 8888` 2. `curl -v -c c.txt --resolve test.co.uk:8888:testserverip http://test.co.UK:8888` 3. `nc -v -l -p 7777` 4. `curl -v -b c.txt --resolve other.co.uk:7777:testserverip http://other.co.uk:7777` Note that the `super` cookie is sent to the `other.com.uk` site. In fact it will be sent to any `.co.uk` hosts now. The generated cookie file: ``` # Netscape HTTP Cookie File # https://curl.se/docs/http-cookies.html # This file was generated by libcurl! Edit at your own risk. .co.UK TRUE / FALSE 0 super oops ``` ## Impact Bypassing supercookie protection.

Source code

No source code was retrieved for this analysis. The evidence may be incomplete.