GHSA-jpw8-42g9-g437: 
Python vulnerability analysis and mitigation

Summary

HARP forwards every proxied request through one shared HTTP client whose cookie jar is enabled. Cookies set by an upstream are stored by the proxy and sent with later requests from other clients, so one user can be sent upstream with another user's session.

Impact

Affects deployments where an upstream sets cookies (for example, session cookies after a login) and more than one client uses the same HARP instance. No HARP configuration is needed to trigger it: the default configuration is vulnerable.

• Any later request that arrives with no Cookie header is sent upstream with the most recently stored cookies for that domain. Its sender then acts as the user who set them. An unauthenticated attacker can take over a session just by sending cookieless requests. Legitimate clients can also end up acting as another user without knowing it.
• Cookies are matched by domain, not port. They therefore also reach other HARP endpoints whose upstream is on the same host, and sibling hosts when the cookie carries a Domain attribute.
• Requests that carry their own Cookie header are forwarded unchanged and are not affected.

Patches

Fixed in 0.11.1 and 0.12.0. The proxy's HTTP client no longer stores cookies. Cookie and Set-Cookie headers are still relayed between clients and upstreams as-is.

Workarounds

No configuration option disables the cookie jar. Until you can upgrade:

• do not proxy upstreams that use cookie-based sessions through a HARP instance shared by several users, or
• make sure every client request carries a Cookie header (the stored cookies are only added to requests that have none), and
• restart HARP to clear any cookies it has already stored.

Details

The http_client service (harp_apps/http_client/services.yml) builds an httpx.AsyncClient with its default cookie jar, and one instance serves the whole process. httpx stores every Set-Cookie header from a response in that jar. harp_apps/proxy/adapters.py builds each upstream request with http_client.build_request(), which merges the jar into the request and adds a Cookie header whenever the incoming request has none.

PoC

1. Run an upstream on 127.0.0.1:4700 that answers /login/<user> with Set-Cookie: session=<user> and echoes back the Cookie header it receives.
2. Start HARP: harp-proxy server --endpoint up=4701:http://127.0.0.1:4700/
3. Victim logs in: curl -i http://127.0.0.1:4701/login/alice (response carries Set-Cookie: session=alice)
4. Another client, with no cookie: curl http://127.0.0.1:4701/whoami. The upstream receives Cookie: session=alice.