Loading HuntDB...

curl --continue-at confusion

Medium
C
curl
Submitted None
Reported by nyymi

Vulnerability Details

Technical details and impact analysis

Business Logic Errors
## Summary: When curl command is used with `--continue-at`, the `--no-clobber` is unexpectedly ignored and curl will append the output to the target file, even if it already exists. If `--continue-at` is used with`--remove-on-error` it can lead to unexpected removal of the file on early errors. Note that this also happens when combined with `--remote-name` and `--remote-header-name`. ## Steps To Reproduce: ### Tampering a file even if `--no-clobber`: 1. `echo not to be touched > robots.txt` 2. `curl --no-clobber -C 1 -O https://curl.se/robots.txt` NOTE: Without `-C 1` the output is written to `robots.txt.<n>`. ### Deleting a file when combining `--remove-on-error` with `--continue-at`: 1. `echo something > important` 2. `curl --remove-on-error -C 1 -o important https://nonexisting.curl.se/` NOTE: Without `-C 1` the file is not removed. ## Remediation The easiest way to stop these issues from happening is to forbid use of `--continue-at` in combination with `--no-clobber` or `--remove-on-error`. ## Impact Unexpected modification or deletion of an existing file.

Report Details

Additional information and metadata

State

Closed

Substate

Not-Applicable

Submitted

Weakness

Business Logic Errors