Path Traversal in curl file:// Protocol Handler Allows Unauthorized File Access
该报告还没有中文解读。
原文摘录
摘自原文（4358 字符中的一小部分）
Summary During my manual review of the file path handling logic in curl's source code, I noticed the absence of proper validation for directory traversal sequences, which I then verified through practical testing. I discovered that curl allows unauthorized access to arbitrary files through the …
原文中的代码
/* Line 229: No validation of "../" sequences */ fd = curlx_open(actual_path, O_RDONLY | CURL_O_BINARY); /* Similar issues at lines 253, 258, 262 */ fd = curlx_open(real_path + 1, O_RDONLY); // Line 253 fd = curlx_open(real_path, O_RDONLY); // Line 258 fd = curlx_open(real_path, O_RDONLY); …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 curl 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @7hackerstar · 版权归作者与 curl 所有