netrc and redirect credential leak

Disclosed: 2025-01-15 12:17:39 By nyymi To ibb
Low
Vulnerability Details
When asked to both use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password. ## Impact Information disclosure (password sent to the wrong host).
Actions
View on HackerOne
Report Stats
  • Report ID: 2894283
  • State: Closed
  • Substate: resolved
  • Upvotes: 4
Share this report