Inconsistent URL Parsing in curl Leading to Potential SSRF and Access Control Bypass

How it was found

0x01 Summary

An inconsistency in URL parsing within curl's URL handling leads to potential security risks such as Server-Side Request Forgery (SSRF) and access control bypasses. Specifically, when parsing URLs containing IPv6 addresses with zone identifiers (e.g., http://[fe80::1%25eth0]/), curl's parser omits the zone identifier, deviating from the expected behavior as per RFC 6874. This inconsistency may cause applications that rely on curl for URL validation and parsing to misinterpret network interfaces, leading to security vulnerabilities.

0x02 Details

2.1 Affected Components

• curl: All versions up to the latest release at the time of reporting.
• libcurl: All versions up to the latest release at the time of reporting.

2.2 Technical Background

According to RFC 6874, when including an IPv6 zone identifier in a URI, the zone identifier must be percent-encoded and included within the square brackets of the IPv6 address literal.

RFC 6874 Section 4:

"This document specifies that the zone identifier is to be appended to the address literal, following a percent sign. The percent sign is URL-escaped in URIs, so that the zone identifier is properly identified as part of the address literal and not as a port or userinfo component."

2.3 Inconsistent Parsing Behavior

The following table demonstrates how different libraries parse URLs containing IPv6 addresses with zone identifiers:

Table: Parsing Results for http://[fe80::1%25eth0]/ and Variants

• Observation: libcurl strips the zone identifier %eth0 from the hostname, resulting in [fe80::1]. In contrast, Go's net/url and Python's urllib preserve the zone identifier as fe80::1%eth0.

2.4 Explanation of the Issue

• Deviation from RFC 6874: The zone identifier is essential for IPv6 link-local addresses to specify the network interface. Omitting it can lead to incorrect network routing or unintended interface usage.
• Inconsistent Parsing: Curl's omission of the zone identifier means that applications using libcurl may inadvertently connect to the wrong interface or fail to connect entirely.
• Security Implications: This behavior can be exploited to bypass network restrictions, leading to SSRF attacks or unauthorized access to resources.

0x03 Attack Scenario

3.1 SSRF Scenario

1. Application Setup: A web application uses libcurl to fetch resources from user-supplied URLs. It relies on libcurl for URL parsing and trusts that requests to link-local addresses are confined to specific interfaces.

2. Attacker's Input: An attacker submits a URL like http://[fe80::1%25eth0]/.

3. Parsing Behavior

   :

   • Expected: The application expects the hostname to be fe80::1%eth0, ensuring the request goes through the eth0 interface.
   • Actual: libcurl parses the hostname as fe80::1, ignoring the %eth0 zone identifier.

4. Exploitation: The request is sent to fe80::1 on the default network interface rather than the intended eth0. An attacker can manipulate the zone identifier to force requests through unintended interfaces, potentially accessing restricted networks or services.

3.2 Access Control Bypass

1. Firewall Rules: An application has firewall rules that allow traffic only through specific interfaces identified by zone identifiers.
2. Bypassing Controls: By exploiting the parsing inconsistency, an attacker can omit the zone identifier, causing the request to bypass the interface restrictions enforced by the application logic.

0x04 Impact

• Server-Side Request Forgery (SSRF): Attackers can manipulate requests to access internal resources.
• Access Control Bypass: Security policies based on network interfaces can be circumvented.
• Information Leakage: Potential exposure of sensitive data if internal services are accessed.

0x05 Mitigation

• Update Parsing Logic: Modify libcurl to adhere strictly to RFC 6874, ensuring that zone identifiers are correctly parsed and preserved.
• Input Validation: Applications should implement additional checks to verify that zone identifiers are present and correctly formatted.
• Upgrade: Encourage users to update to the patched version of curl once a fix is released.

0x06 References

1. RFC 6874: Representing IPv6 Zone Identifiers in Address Literals and Uniform Resource Identifiers
2. CWE-939: Improper Handling of URL Encoded Syntax
3. CWE-918: Server-Side Request Forgery (SSRF)

Impact

• Server-Side Request Forgery (SSRF): Attackers can manipulate requests to access internal resources.
• Access Control Bypass: Security policies based on network interfaces can be circumvented.
• Information Leakage: Potential exposure of sensitive data if internal services are accessed.