CURL-CVE-2023-27534
- Source
- https://curl.se/docs/CVE-2023-27534.html
- Import Source
- https://curl.se/docs/CURL-CVE-2023-27534.json
- JSON Data
- https://api.osv.dev/v1/vulns/CURL-CVE-2023-27534
- Aliases
- Published
- 2023-03-20T08:00:00Z
- Modified
- 2024-01-25T02:42:51.734800Z
- Summary
- SFTP path ~ resolving discrepancy
- Details
-
curl supports SFTP transfers. curl's SFTP implementation offers a special feature in the path component of URLs: a tilde (
~) character as the first path element in the path to denotes a path relative to the user's home directory. This is supported because of wording in the once proposed to-become RFC draft that was to dictate how SFTP URLs work.Due to a bug, the handling of the tilde in SFTP path did however not only replace it when it is used stand-alone as the first path element but also wrongly when used as a mere prefix in the first element.
Using a path like
/~2/foowhen accessing a server using the userdan(with home directory/home/dan) would then quite surprisingly access the file/home/dan2/foo.This can be taken advantage of to circumvent filtering or worse.
- Database specific
{ "CWE": { "id": "CWE-22", "desc": "Improper Limitation of a Pathname to a Restricted Directory" }, "award": { "amount": "480", "currency": "USD" }, "URL": "https://curl.se/docs/CVE-2023-27534.json", "package": "curl", "severity": "Low", "issue": "https://hackerone.com/reports/1892351", "www": "https://curl.se/docs/CVE-2023-27534.html", "last_affected": "7.88.1" }- References
-
- Credits
-
-
- Harry Sintonen - FINDER
-
- Daniel Stenberg - REMEDIATION_DEVELOPER
-
Affected packages
Git / github.com/curl/curl.git
Affected ranges
- Type
- SEMVER
- Events
-
Introduced7.18.0Fixed8.0.0
- Type
- GIT
- Repo
- https://github.com/curl/curl.git
- Events