# [CVE-2023-38546] cookie injection with none file

curl_easy_duphandle clones cookie-enabled state but stores filename 'none' when no cookie file was read, so a cloned handle loads cookies from a file named 'none' in the CWD.

- Payout: hidden
- Severity: low
- Program: Internet Bug Bounty
- Found by: w0x42
- Disclosed: 2023-11-23
- CVE: CVE-2023-38546
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2215578
- Library page: https://bugbountylibrary.com/r/h1%3A2215578
- Tags: area:oss domain:oss impact:integrity kind:bounty platform:hackerone sev:low tech:curl technique:source-review vuln:misconfiguration

**Target:** libcurl easy handle duplication (curl_easy_duphandle)
**Root cause:** When duplicating an easy handle with cookies enabled but no cookie file previously read, the cloned handle stores the literal string 'none' as the cookie filename instead of leaving it unset.
**Steps:**
1. Create an easy handle with CURLOPT_COOKIEFILE set but never read cookies from a file.
2. Call `curl_easy_duphandle` to clone the handle.
3. Use the cloned handle without setting a cookie source; libcurl attempts to load cookies from a file named `none` in the current working directory.
4. Place a file named `none` in the CWD in Netscape cookie format to inject arbitrary cookies.
**Exploitation:** Attacker who can write a file named 'none' in the process's working directory (or influence CWD) gets arbitrary cookies injected into requests made by the cloned handle, potentially hijacking sessions or auth state.
**Insight:** When auditing handle/state duplication APIs, check whether unset fields are serialized as sentinel strings like 'none' that later get interpreted as real filenames or values.