the new version of the utility for receiving and sending data over the network — , providing the ability to flexibly formulate requests with parameters such as cookie, user_agent, referer, and any other headers. cURL supports HTTP, HTTPS, HTTP/2.0, HTTP/3, SMTP, IMAP, POP3, Telnet, FTP, LDAP, RTSP, RTMP, and other network protocols. At the same time, an update was released for the concurrently developed libcurl library, which provides an API to utilize all cURL functions in programs written in languages such as C, Perl, PHP, Python.
The new release includes the option '—retry-all-errors' to retry operations when any errors occur, and two vulnerabilities have been fixed:
- allows overwriting a local file on the system when accessing a server controlled by an attacker. The issue only manifests when using the options '-J' ('—remote-header-name') and '-i' ('—head') simultaneously. The '-J' option allows saving the file with the name specified in the header
‘Content-Disposition’. If a file with that name already exists, the curl program normally refuses to overwrite it, but if the '-i' option is present, the logic check is violated, and the file is overwritten (the check is performed at the stage of receiving the response body, but with the '-i' option, HTTP headers are printed first, and they are saved before processing the response body begins). Only the HTTP headers are written to the file, but the server can return arbitrary data instead of headers, which will be saved. - may lead to the leakage of some access passwords to the site (Basic, Digest, NTLM, etc.) to the DNS server. When using the '@' symbol in the password, which is also used as a password delimiter in URLs, during HTTP redirection, curl will send the part of the password after the '@' along with the domain for name resolution. For example, with the password 'passw@rd123' and the username 'dan', curl will generate the URL 'https://dan:passw@rd123@example.com/path' instead of 'https://dan:passwrd123@example.com/path' and will send a request to resolve the host 'rd123@example.com' instead of 'example.com'.
The issue arises when enabling support for relative HTTP redirects (disabled via CURLOPT_FOLLOWLOCATION). In the case of traditional DNS usage, a DNS provider and an attacker capable of intercepting transit network traffic can obtain part of the password information (even if the initial request was made over HTTPS, as DNS traffic is not encrypted). When using DNS-over-HTTPS (DoH), the leak is limited to the DoH operator.
Source: opennet.ru
