Confirmed Security Misconfigurations on curl.se (BREACH, Missing Security Headers, ETag Info Disclosure)

How it was found

Summary:

During a security assessment of curl.se, multiple misconfigurations were identified that led to information disclosure or weakened the security posture of the website.

Affected version:

Website: https://curl.se Tested on: 09-09-2025 curl version: curl/8.8.0 (x86_64-pc-linux-gnu)

Steps To Reproduce:

1. Run a scan with Nikto against https://curl.se
2. Observe the following results:
   • The server sets "Content-Encoding: deflate" → indicates possible BREACH attack.
   • The header "X-Content-Type-Options: nosniff" is missing.
   • The server returns ETag values with inode/size/mtime.

Supporting Material/References:

• BREACH attack: http://breachattack.com/
• Missing Header: https://owasp.org/www-project-secure-headers/
• ETag Disclosure: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1418

Impact:

• BREACH attack allowed disclosure of CSRF tokens, session IDs, and sensitive data through compression side-channel attacks.
• Missing X-Content-Type-Options allowed MIME sniffing, increasing risk of XSS.
• ETag values leaked server-side information (inode, size, mtime) useful for reconnaissance and cache-based attacks. Overall, these misconfigurations reduced the security posture of the target application.

No AI tools were used in generating this report. All findings were confirmed manually using Nikto.

Impact

Summary:

The identified issues have been confirmed during testing:

• BREACH attack confirmed: the server uses "deflate" compression, allowing practical exploitation to recover sensitive data such as session tokens and CSRF tokens from HTTPS responses.
• Missing X-Content-Type-Options confirmed: this allows browsers to perform MIME-sniffing attacks, increasing the risk of XSS.
• ETag values confirmed: inode, size, and modification time of server files were disclosed, leaking internal implementation details that can be used for reconnaissance or cache-based attacks.

Overall, these confirmed misconfigurations reduce the security posture of curl.se and create exploitable vectors for attackers.