Loading HuntDB...

Unexpected access to process open files via file:///proc/self/fd/n

High
C
curl
Submitted None
Reported by nyymi

Vulnerability Details

Technical details and impact analysis

Information Disclosure
## Summary: file_connect() routine (https://github.com/curl/curl/blob/1b71bc532bde8621fd3260843f8197182a467ff2/lib/file.c#L134) does not prevent access to /proc/self/fd pseudo filesystem. Application using libcurl and accepting URLs to fetch can be tricked to return content of any open file by passing a specially crafted file:///proc/self/fd/<number> URLs. Since the specific files are open by the application itself, they will always be accessible as long as the files remain open. This will bypass for example drop of privileges performed after opening the file(s). ## Steps To Reproduce: [add details for how we can reproduce the issue] 1. Open a privileged file (for example /etc/shadow) 2. Drop the process privileges 3. Accept URL as user input 4. Fetch URL with libcurl 5. Send received data to user ## Supporting Material/References: ## Impact Authorization bypass: Access to privileged files otherwise not accessible via file://

Report Details

Additional information and metadata

State

Closed

Substate

Informative

Submitted

Weakness

Information Disclosure