Internet Bug Bounty · Report #1565623
CVE-2022-27778: curl removes wrong file on error
Summary
curl removes wrong file on error
Project curl Security Advisory, May 11 2022 - Permalink
VULNERABILITY
curl might remove the wrong file when --no-clobber is used together with --remove-on-error.
The --remove-on-error option tells curl to remove the output file when it returns an error, and not leave a partial file behind. The --no-clobber option prevents curl from overwriting a file if it already exists, and instead append a number to the name to create a new unused file name.
If curl adds a number to not "clobber" the output and an error occur during transfer, the remove on error logic would remove the original file name without the added number.
We are not aware of any exploit of this flaw.
INFO
This flaw is only present in the command line tool, not the library.
This flaw was introduced in curl 7.83.0 with the addition of these two options that together created this problem. Since both these command line options are brand new in this version, chances are not too many users have actually had time to experience this problem.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2022-27778 to this issue.
CWE-706: Use of Incorrectly-Resolved Name or Reference
Severity: Medium
AFFECTED VERSIONS
THE SOLUTION
RECOMMENDATIONS
A - Upgrade curl to version 7.83.1
B - Apply the patch to your local version
C - Do not use --no-clobber with --remove-on-error
TIMELINE
This issue was reported to the curl project on April 28, 2022. We contacted distros@openwall on May 5.
libcurl 7.83.1 was released on May 11 2022, coordinated with the publication of this advisory.
LINK TO THE ADVISORY
How it was found
Summary:
Curl command has a logic flaw that results in removal of a wrong file when combining --no-clobber and --remove-on-error if the target file name exists and an error occurs.
Steps To Reproduce:
echo "important file" > fooecho -ne "HTTP/1.1 200 OK\r\nContent-Length: 666\r\n\r\nHello\n" | nc -l -p 9999curl -m 3 --no-clobber --remove-on-error --output foo http://testserver.tld:9999/ls -l foo*cat foo.1
-m 3 is used here to simulate a denial of service of the connection performed by the attacker.
Impact
Removal of a file that was supposed not to be overwritten (data loss). Incomplete file left of disk when it should have been removed. This can lead to potential loss of integrity or availability.