Low priority HSTS bypass in curl_easy_duphandle()
信息泄露 / Information Exposure Through Sent Data / #3769293
该报告还没有中文解读。
原文摘录
摘自原文（4531 字符中的一小部分）
curl_easy_duphandle() creates a fresh HSTS store for the cloned handle and populates it from the configured files and callbacks, but never copies entries acquired from Strict-Transport-Security response headers during the parent's lifetime. This means the client using a cloned handle may …
原文中的代码
... * Switched from HTTP to HTTPS due to HSTS => https://x.test/secret * Alt-svc check wanted=1, allowed=1 * check Alt-Svc for host 'x.test' ... * SSL Trust: peer verification disabled * TLS connect error: error:00000000:lib(0)::reason(0) * OpenSSL SSL_connect: Broken pipe in connection to …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 curl 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @ajohnston3825 · 版权归作者与 curl 所有