Cross‑origin cookies leak and injection risk when using a custom Host header
该报告还没有中文解读。
原文摘录
摘自原文（4693 字符中的一小部分）
Summary When a custom hostname is specified, it is used for cookie matching if the cookie engine is also enabled for this transfer. This matching persists in cross-origin redirects despite that the originally supplied hostname is removed.
原文中的代码
ptr = Curl_checkheaders(data, STRCONST("Host"));
if(ptr && (!data->state.this_is_a_follow || curl_strequal(data->state.first_host, conn->host.name))) {
/* If we have a given custom Host: header, we extract the hostname in
order to possibly use it for cookie reasons later on. We only …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 curl 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @b4c90000040c1287364ccde6de680 · 版权归作者与 curl 所有