Internet Bug Bounty · Report #2894283

netrc and redirect credential leak

Validstatus

lowseverity

$505bounty

49upvotes

15 Jan 2025disclosed

Summary

netrc and redirect credential leak Project curl Security Advisory, December 11th 2024 - https://curl.se/docs/CVE-2024-11053.html

VULNERABILITY When asked to both use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances.

This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.

How it was found

When asked to both use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances.

This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.

Impact

Information disclosure (password sent to the wrong host).

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original