CURL-CVE-2020-8177
- Source
- https://curl.se/docs/CVE-2020-8177.html
- Import Source
- https://curl.se/docs/CURL-CVE-2020-8177.json
- JSON Data
- https://api.osv.dev/v1/vulns/CURL-CVE-2020-8177
- Aliases
- Published
- 2020-06-24T08:00:00Z
- Modified
- 2024-06-07T13:53:51Z
- Summary
- curl overwrite local file with -J
- Details
-
curl can be tricked by a malicious server to overwrite a local file when using
-J(--remote-header-name) and-i(--include) in the same command line.The command line tool offers the
-Joption that saves a remote file using the filename present in theContent-Disposition:response header. curl then refuses to overwrite an existing local file using the same name, if one already exists in the current directory.The
-Jflag is designed to save a response body, and so it does not work together with-iand there is logic that forbids it. However, the check is flawed and does not properly check for when the options are used in the reversed order: first using-Jand then-iwere mistakenly accepted.The result of this mistake was that incoming HTTP headers could overwrite a local file if one existed, as the check to avoid the local file was done first when body data was received, and due to the mistake mentioned above, it could already have received and saved headers by that time.
The saved file would only get response headers added to it, as it would abort the saving when the first body byte arrives. A malicious server could however still be made to send back virtually anything as headers and curl would save them like this, until the first CRLF-CRLF sequence appears.
(Also note that
-Jneeds to be used in combination with-Oto have any effect.) - References
-
- Credits
-
-
- sn on hackerone - FINDER
-
- Daniel Stenberg - REMEDIATION_DEVELOPER
-
Affected packages
Git / github.com/curl/curl.git
Affected ranges
- Type
- SEMVER
- Events
-
Introduced7.20.0Fixed7.71.0
- Type
- GIT
- Repo
- https://github.com/curl/curl.git
- Events