Internet Bug Bounty · Report #2279759
curl HSTS long file name clears contents
Summary
HSTS long file name clears contents
VULNERABILITY When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.
INFO The reason for this bug is that save function appended a suffix to the file name, created a temporary file and then in the last step renamed that to the final name. When the file name length was close to the limit of what is allowed on the file system, adding the extension would make it too long and then trigger this bug.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2023-46219 to this issue.
CWE-311: Missing Encryption of Sensitive Data
Severity: Low
Link to Security Advisory: https://curl.se/docs/CVE-2023-46219.html
How it was found
VULNERABILITY
When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.
INFO
The reason for this bug is that save function appended a suffix to the file name, created a temporary file and then in the last step renamed that to the final name. When the file name length was close to the limit of what is allowed on the file system, adding the extension would make it too long and then trigger this bug.
Hackerone ticket #2236133
Impact
HSTS bypass