ARG_CLEAR credential scrubbing wipes only UTF-8 copies on Windows Unicode builds

How it was found

cleanarg() operates on char *str, which is the UTF-8 copy allocated by convert_tchar_to_UTF8(). It has no reference to the original wchar_t argv[] element.

/* tool_getparam.c:632 */
static void cleanarg(char *str)
{
  /* now that getstr has copied the contents of nextarg, wipe the next
   * argument out so that the username:password is not displayed in the
   * system process list */
  if(str) {
    size_t len = strlen(str);
    memset(str, '*', len);
  }
}

In parse_args() (line 3115), the conversion and scrub flow is:

orig_opt = convert_tchar_to_UTF8(argv[i]);      /* UTF-8 copy of the option */
nextarg  = convert_tchar_to_UTF8(argv[i + 1]);  /* UTF-8 copy of the value  */
err = getparameter(orig_opt, nextarg, ...);
/* inside getparameter, line 3090: */
if(a->desc & ARG_CLEAR)
    cleanarg(CURL_UNCONST(nextarg));             /* scrubs the UTF-8 copy    */
unicodefree(CURL_UNCONST(nextarg));              /* frees the UTF-8 copy     */
/* argv[i+1] — the original wchar_t pointer — is never touched */

The original wchar_t argv[i + 1] buffer, which is part of the process command line visible through the PEB, is never overwritten by cleanarg() or any other routine. unicodefree() only frees the converted copy, not the original.

Impact

A co-located process or user with permission to enumerate process command lines can read credentials supplied via --user, --proxy-user, --pass, --oauth2-bearer, --proxy-pass, --tlspassword, --proxy-tlspassword, --cert, --proxy-cert, --httpsig-key, or --tlsuser for the entire duration of the curl transfer. This defeats the explicit security goal of cleanarg(), which curl's own source comments describe as hiding "username:password" from "the system process list."

The attack requires local access (AV:L) with low privilege (PR:L) — any authenticated Windows user can call wmic process get commandline or Get-CimInstance Win32_Process. No user interaction is needed (UI:N) and the impact is high confidentiality loss (C:H) of the exposed credentials.