Conversation

We got this "HIGH security problem" in earlier today:

"The -o / --output parameter in cURL does not restrict or sanitize file paths. When passed relative traversal sequences (e.g., ../../), cURL writes files outside the current working directory, allowing arbitrary file overwrite. In automated or privileged environments (CI/CD, root containers), this leads to Remote Code Execution (RCE), privilege escalation, and supply chain risk."

Never a dull moment.

2
8
1

Same user followed up with a second severity HIGH security problem.

"The --capath option in cURL and CURLOPT_CAPATH in libcurl accept any directory path without validation. If an attacker provides a custom CA path containing a fake root certificate, cURL will trust malicious HTTPS endpoints signed with that fake root."

I'm fortunate to get to work with the best people 🤠

3
1
1

@bagder critical security vulnerability: if an attacker replaces the curl binary it can perform attacker-defined actions

0
1
6

@bagder

Guys, I just opened a file in my text editor and then I was able to overwrite any file further up in the path? This is an unacceptable security risk!

0
0
0

@bagder If only we could see the security reports they made to the `rm` maintainers.

Or `chmod`!

0
1
0
@bagder Ah yes, high dudeweed security problems
0
1
0