CVE-2022-32207

Vulnerability

When curl versions prior to 7.84.0 save cookies, alt-svc, or HSTS data to local files, it uses an atomic save mechanism: writing to a temporary file then renaming it to the final target name. During the rename operation, the permissions of the target file may be inadvertently widened, leaving the updated file accessible to more users than intended. This affects all curl releases before 7.84.0.

Exploitation

An attacker does not require any special privileges; the vulnerability occurs during normal curl operation. If a user runs curl to save cookies or other data, the resulting file may have broader permissions than intended. An attacker with local access to the system can then read the file, gaining access to sensitive data such as cookies, alt-svc mappings, or HSTS entries. No user interaction beyond running curl is required.

Impact

Successful exploitation leads to information disclosure. An attacker can read the saved cookies, alt-svc, or HSTS data, potentially compromising user sessions or security policies. The attacker gains access at the privilege level of any local user who can read the file.

Mitigation

Upgrade to curl 7.84.0 or later, where the permission widening issue is fixed. Gentoo users should upgrade to >=net-misc/curl-7.86.0 [3]. If upgrading is not possible, avoid using curl to save cookies, alt-svc, or HSTS data to shared or world-readable locations.