Unexpected access to process open files via file:///proc/self/fd/n
High
C
curl
Submitted None
Actions:
Reported by
nyymi
Vulnerability Details
Technical details and impact analysis
## Summary:
file_connect() routine (https://github.com/curl/curl/blob/1b71bc532bde8621fd3260843f8197182a467ff2/lib/file.c#L134) does not prevent access to /proc/self/fd pseudo filesystem. Application using libcurl and accepting URLs to fetch can be tricked to return content of any open file by passing a specially crafted file:///proc/self/fd/<number> URLs. Since the specific files are open by the application itself, they will always be accessible as long as the files remain open. This will bypass for example drop of privileges performed after opening the file(s).
## Steps To Reproduce:
[add details for how we can reproduce the issue]
1. Open a privileged file (for example /etc/shadow)
2. Drop the process privileges
3. Accept URL as user input
4. Fetch URL with libcurl
5. Send received data to user
## Supporting Material/References:
## Impact
Authorization bypass: Access to privileged files otherwise not accessible via file://
Report Details
Additional information and metadata
State
Closed
Substate
Informative
Submitted
Weakness
Information Disclosure