Bug 1173027 (CVE-2020-8177)

Summary: VUL-0: CVE-2020-8177: curl: overwrites local files when using -J (--remote-header-name)
Product: [Novell Products] SUSE Security Incidents Reporter: Wolfgang Frisch <wolfgang.frisch>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: atoptsoglou, meissner, pmonrealgonzalez
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/261680/
Whiteboard: CVSSv3.1:SUSE:CVE-2020-8177:8.1:(AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H)
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Comment 5 Marcus Meissner 2020-06-24 06:49:29 UTC
is public now

curl overwrite local file with -J
=================================

Project curl Security Advisory, June 24th 2020 -
[Permalink](https://curl.haxx.se/docs/CVE-2020-8177.html)

VULNERABILITY
-------------

curl can be tricked my a malicious server to overwrite a local file when using
`-J` (`--remote-header-name`) and `-i` (`--head`) in the same command line.

The command line tool offers the `-J` option that saves a remote file using
the file name present in the `Content-Disposition:` response header. curl then
refuses to overwrite an existing local file using the same name, if one
already exists in the current directory.

The `-J` flag is designed to save a response body, and so it doesn't work
together with `-i` and there's logic that forbids it. However, the check is
flawed and doesn't properly check for when the options are used in the
reversed order: first using `-J` and then `-i` were mistakenly accepted.

The result of this mistake was that incoming HTTP headers could overwrite a
local file if one existed, as the check to avoid the local file was done first
when body data was received, and due to the mistake mentioned above, it could
already have received and saved headers by that time.

The saved file would only get response headers added to it, as it would abort
the saving when the first body byte arrives. A malicious server could however
still be made to send back virtually anything as headers and curl would save
them like this, until the first CRLF-CRLF sequence appears.

(Also note that `-J` needs to be used in combination with `-O` to have any
effect.)

We are not aware of any exploit of this flaw.

INFO
----

Users should be aware and *never* run curl with the `-J` option in their
`$HOME` or other sensitive directories, independently of this flaw. Using curl
that way allows curl to create any file name it likes (i.e. what the remote
server suggests) and it can confuse or trick users if allowed to save files
that can mistakenly be assumed to be "locally made" or part of the system
rather than provided by a potentially malicious remote party.

This bug was brought in commit
[80675818e0417b](https://github.com/curl/curl/commit/80675818e0417b) when `-J`
was introduced to curl, first shipped in curl 7.20.0.

This flaw can happen to users of the curl tool but **not** for applications
using libcurl.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2020-8177 to this issue.

CWE-641: Improper Restriction of Names for Files and Other Resources

Severity: 4.7 (Medium)

AFFECTED VERSIONS
-----------------

- Affected versions: curl 7.20.0 to and including 7.70.0
- Not affected versions: curl < 7.20.0 and curl >= 7.71.0

THE SOLUTION
------------

A [fix for CVE-2020-8177](https://github.com/curl/curl/commit/8236aba58542c5f.patch)

RECOMMENDATIONS
--------------

We suggest you take one of the following actions immediately, in order of
preference:

  A - Upgrade curl to version 7.71.0

  B - Apply the patch on your curl version and rebuild

  C - Do not use `-J` (in a directory with pre-existing files)

TIMELINE
--------

This issue was first reported to the curl project on May 30, 2020.

This advisory was posted on June 24th 2020.

CREDITS
-------

This issue was reported by sn on hackerone. Patched by Daniel Stenberg.

Thanks a lot!

-- 

  / daniel.haxx.se | Commercial curl support up to 24x7 is available!
                   | Private help, bug fixes, support, ports, new features
                   | https://www.wolfssl.com/contact/
Comment 6 Pedro Monreal Gonzalez 2020-06-24 09:00:31 UTC
Factory submission:
   https://build.opensuse.org/request/show/816803
Comment 8 Swamp Workflow Management 2020-06-24 13:12:50 UTC
SUSE-SU-2020:1732-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1173027
CVE References: CVE-2020-8177
Sources used:
SUSE OpenStack Cloud Crowbar 8 (src):    curl-7.37.0-37.47.1
SUSE OpenStack Cloud 8 (src):    curl-7.37.0-37.47.1
SUSE OpenStack Cloud 7 (src):    curl-7.37.0-37.47.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    curl-7.37.0-37.47.1
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    curl-7.37.0-37.47.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    curl-7.37.0-37.47.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    curl-7.37.0-37.47.1
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    curl-7.37.0-37.47.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    curl-7.37.0-37.47.1
SUSE Enterprise Storage 5 (src):    curl-7.37.0-37.47.1
HPE Helion Openstack 8 (src):    curl-7.37.0-37.47.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 9 Swamp Workflow Management 2020-06-24 13:14:33 UTC
SUSE-SU-2020:14409-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1173027
CVE References: CVE-2020-8177
Sources used:
SUSE Linux Enterprise Server 11-SP4-LTSS (src):    curl-7.37.0-70.47.1
SUSE Linux Enterprise Server 11-SECURITY (src):    curl-openssl1-7.37.0-70.47.1
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    curl-7.37.0-70.47.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    curl-7.37.0-70.47.1
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    curl-7.37.0-70.47.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 10 Swamp Workflow Management 2020-06-24 13:15:15 UTC
SUSE-SU-2020:1734-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1173027
CVE References: CVE-2020-8177
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    curl-7.60.0-11.3.2
SUSE Linux Enterprise Server 12-SP5 (src):    curl-7.60.0-11.3.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Swamp Workflow Management 2020-06-24 13:18:09 UTC
SUSE-SU-2020:1733-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1173026,1173027
CVE References: CVE-2020-8169,CVE-2020-8177
Sources used:
SUSE Linux Enterprise Module for Basesystem 15-SP2 (src):    curl-7.66.0-4.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 12 Swamp Workflow Management 2020-06-24 13:20:53 UTC
SUSE-SU-2020:1735-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1173027
CVE References: CVE-2020-8177
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP4 (src):    curl-7.60.0-4.15.2
SUSE Linux Enterprise Server 12-SP4 (src):    curl-7.60.0-4.15.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 13 OBSbugzilla Bot 2020-06-25 06:00:11 UTC
This is an autogenerated message for OBS integration:
This bug (1173027) was mentioned in
https://build.opensuse.org/request/show/816919 15.2 / curl
Comment 14 Swamp Workflow Management 2020-06-26 10:17:15 UTC
SUSE-SU-2020:1773-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1173027
CVE References: CVE-2020-8177
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    curl-7.60.0-3.29.1
SUSE Linux Enterprise Server 15-LTSS (src):    curl-7.60.0-3.29.1
SUSE Linux Enterprise Module for Basesystem 15-SP1 (src):    curl-7.60.0-3.29.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    curl-7.60.0-3.29.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    curl-7.60.0-3.29.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 15 Swamp Workflow Management 2020-06-27 22:13:05 UTC
openSUSE-SU-2020:0883-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1173026,1173027
CVE References: CVE-2020-8169,CVE-2020-8177
Sources used:
openSUSE Leap 15.2 (src):    curl-7.66.0-lp152.3.3.1, curl-mini-7.66.0-lp152.3.3.1
Comment 16 Swamp Workflow Management 2020-06-29 22:19:59 UTC
openSUSE-SU-2020:0908-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1173027
CVE References: CVE-2020-8177
Sources used:
openSUSE Leap 15.1 (src):    curl-7.60.0-lp151.5.12.1, curl-mini-7.60.0-lp151.5.12.1
Comment 17 Alexandros Toptsoglou 2020-06-30 07:31:21 UTC
Done