CVE-2020-8169

Vulnerability

In curl versions 7.62.0 through 7.70.0, libcurl fails to URL-encode credentials set via CURLOPT_USERPWD, CURLOPT_USERNAME, or CURLOPT_PASSWORD options. When a relative HTTP redirect (a Location header with a relative path) is followed, curl constructs a full URL by combining components. Because the credentials are not URL-encoded, the subsequent re-parsing of the URL incorrectly treats a portion of the password as part of the hostname. This partial password is then included in DNS queries and transmitted over the network [1].

Exploitation

An attacker must control a server that sends a relative redirect to a client using an affected curl version. The client must have HTTP authentication credentials set via the curl_easy_setopt options (not embedded in the URL). The attacker can then observe DNS queries or network traffic to capture the leaked portion of the password [1].

Impact

A partial password is disclosed to DNS servers and any network observer. This information disclosure reduces the effective password entropy and may aid in further attacks, such as brute-forcing the remaining characters [1].

Mitigation

The vulnerability is fixed in curl version 7.71.0, released on June 24, 2020. Users should upgrade to curl 7.71.0 or later. No workaround is available for affected versions [1].