HSTS accepted from HTTP origin behind HTTPS proxy
其他弱点 / Acceptance of Extraneous Untrusted Data With Trusted Data / #3609505
该报告还没有中文解读。
原文摘录
摘自原文（1734 字符中的一小部分）
curl/libcurl appears to accept and persist Strict-Transport-Security from an http:// origin when the request is sent through an https:// proxy. After that, a later http:// request for the same host is automatically upgraded to https:// due to stored HSTS state.
原文中的代码
curl -v \ --proxy https://127.0.0.1:18443 --proxy-insecure \ --hsts ./hsts-cache.txt \ http://hsts-probe.test:18080/
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 curl 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @lg_oled77c5pua · 版权归作者与 curl 所有