curl mishandles `%0c%0b` sequences in HTTP responses leading to CRLF confusions, Headers and Cookies Injection
该报告还没有中文解读。
原文摘录
摘自原文（2323 字符中的一小部分）
Actually, this bug was found unexpectedly during some security audits on a private asset, we found some differences on how burp proxy/python's requests library handles the asset's HTTP responses on a certain endpoint and how curl handles the same HTTP responses, the bug arises when curl treats `%0c …
原文中的代码
gk@GKs-MacBook-Air ~ % curl "https://private.asset:8100/sap/public/bc/icf/logoff?redirecturl=//google.com/%0cX-Injected-Header:%20test" -I
HTTP/1.1 302 Moved temporarily
content-type: text/html; charset=utf-8
content-length: 17
location: //google.com/
X-Injected-Header: test默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 curl 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @mdakh404 · 版权归作者与 curl 所有