Bug 1198608 - (CVE-2022-27774) VUL-1: CVE-2022-27774: curl: Credential leak on redirect
(CVE-2022-27774)
VUL-1: CVE-2022-27774: curl: Credential leak on redirect
Status: IN_PROGRESS
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P4 - Low : Minor
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/329490/
CVSSv3.1:SUSE:CVE-2022-27774:6.2:(AV:...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2022-04-19 11:26 UTC by Marcus Meissner
Modified: 2022-05-11 11:45 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 4 Robert Frohl 2022-04-27 06:45:56 UTC
oss-security:

Credential leak on redirect
===========================

Project curl Security Advisory, April 27th 2022 -
[Permalink](https://curl.se/docs/CVE-2022-27774.html)

VULNERABILITY
-------------

curl follows HTTP(S) redirects when asked to. curl also supports
authentication. When a user and password are provided for a URL with a given
hostname, curl makes an effort to not pass on those credentials to other hosts
in redirects unless given permission with a special option.

This "same host check" has been flawed all since it was introduced. It does
not work on cross protocol redirects and it does not consider different port
numbers to be separate hosts. This leads to curl leaking credentials to other
servers when it follows redirects from auth protected HTTP(S) URLs to other
protocols and port numbers. It could also leak the TLS SRP credentials this
way.

By default, curl only allows redirects to HTTP(S) and FTP(S), but can be asked
to allow redirects to all protocols curl supports.

We are not aware of any exploit of this flaw.

INFO
----

This flaw was added in curl 4.9 with the introduction of `--location` and has
been present in all libcurl versions ever released. In July 2000 in the curl
7.1.1 release, [this commit](https://github.com/curl/curl/commit/29eda80f9669f) was the first
version that attempted to avoid this, but the check has been bad since then.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2022-27774 to this issue.

CWE-522: Insufficiently Protected Credentials

Severity: Medium

AFFECTED VERSIONS
-----------------

- Affected versions: curl 4.9 to and including 7.82.0
- Not affected versions: curl < 4.9 and curl >= 7.83.0

Note that libcurl is used by many applications, but not always advertised as
such.

THE SOLUTION
------------

There are two separate patches to apply for CVE-2022-27774: [the main
one](https://github.com/curl/curl/commit/620ea21410030a997) and [the SRP
follow-up](https://github.com/curl/curl/commit/139a54ed0a172ada).

RECOMMENDATIONS
---------------

We suggest you take one of the following actions immediately, in order of
preference:

 A - Upgrade curl and libcurl to version 7.83.0

 B - Apply the patches to your version and rebuild

 C - Switch off curl's automatic redirect following

TIME LINE
---------

It was first reported to the curl project on April 18 2022. We contacted
distros@openwall on April 19.

libcurl 7.83.0 was released on April 27 2022, coordinated with the
publication of this advisory.

CREDITS
-------

Reported by Harry Sintonen.

Thanks a lot!