Summary
Set cookie for different domain in guzzle/guzzle.
Product
guzzle/guzzle prior to version 6.5.6 and 7.x prior to 7.4.3.
Impact
The vulnerability is capable of stealing sessions if the right conditions are met.
Steps to reproduce
require "vendor/autoload.php";
$client = new GuzzleHttpClient(["cookies" => true]);
$client->request("GET", "https://<id>.free.beeceptor.com/setcookie");
$cookies = $client->getConfig('cookies')->toArray();
print_r($cookies);
?>You can use beeceptor to mock the endpoint, just add the following header to the response: “Set-Cookie”: “poc=1; Domain=huntr.dev”
Also works with .com as domain, this would send the cookie to all .com domains.
Remediation
Update guzzle/guzzle to version 6.5.6 or 7.4.3.
Credit
This issue was reported by @myyxl through huntr.dev.
