Penetration Test Report (TrailOfBits): 2022 12 curl securityreview

cURL
Security Assessment
December 20, 2022
Prepared for:
Daniel Stenberg, cURL
Open Source Security Foundation (OpenSSF)
Open Source Technology Improvement Fund
Prepared by: Emilio López, Spencer Michaels, and Paweł Płatek
About Trail of Bits
Founded in 2012 and headquartered in New York, Trail of Bits provides technical security
assessment and advisory services to some of the world’s most targeted organizations. We
combine high- end security research with a real -world attacker mentality to reduce risk and
fortify code. With 100+ employees around the globe, we’ve helped secure critical software
elements that support billions of end users, including Kubernetes and the Linux kernel.
We maintain an exhaustive list of publications at https://github.com/trailofbits/publications ,
with links to papers, presentations, public audit reports, and podcast appearances.
In recent years, Trail of Bits consultants have showcased cutting-edge research through
presentations at CanSecWest, HCSS, Devcon, Empire Hacking, GrrCon, LangSec, NorthSec,
the O’Reilly Security Conference, PyCon, REcon, Security BSides, and SummerCon.
We specialize in software testing and code review projects, supporting client organizations
in the technology, defense, and finance industries, as well as government entities. Notable
clients include HashiCorp, Google, Microsoft, Western Digital, and Zoom.
Trail of Bits also operates a center of excellence with regard to blockchain security. Notable
projects include audits of Algorand, Bitcoin SV, Chainlink, Compound, Ethereum 2.0,
MakerDAO, Matic, Uniswap, Web3, and Zcash.
To keep up to date with our latest news and announcements, please follow @trailofbits on
Twitter and explore our public repositories at https://github.com/trailofbits . To engage us
directly, visit our “Contact” page at https://www.trailofbits.com/contact , or email us at
info@trailofbits.com .
Trail of Bits, Inc.
228 Park Ave S #80688
New York, NY 10003
https://www.trailofbits.com
info@trailofbits.com
Trail of Bits 1 cURL Security Assessment
PUBLIC
Notices and Remarks
Copyright and Distribution
© 2022 by Trail of Bits, Inc.
All rights reserved. Trail of Bits hereby asserts its right to be identified as the creator of this
report in the United Kingdom.
This report is considered by Trail of Bits to be public information; it is licensed to the cURL
project under the terms of the project statement of work and has been made public at the
project’s request. Material within this report may not be reproduced or distributed in part
or in whole without the express written permission of Trail of Bits.
Test Coverage Disclaimer
All activities undertaken by Trail of Bits in association with this project were performed in
accordance with a statement of work and agreed upon project plan.
Security assessment projects are time-boxed and often reliant on information that may be
provided by a client, its affiliates, or its partners. As a result, the findings documented in
this report should not be considered a comprehensive list of security issues, flaws, or
defects in the target system or codebase.
Trail of Bits uses automated testing techniques to rapidly test the controls and security
properties of software. These techniques augment our manual security review work, but
each has its limitations: for example, a tool may not generate a random edge case that
violates a property or may not fully complete its analysis during the allotted time. Their use
is also limited by the time and resource constraints of a project.
Trail of Bits 2 cURL Security Assessment
PUBLIC
Table of Contents
About Trail of Bits 1
Notices and Remarks 2
Table of Contents 3
Executive Summary 5
Project Summary 7
Project Goals 8
Project Targets 9
Project Coverage 10
Fuzzing Coverage Assessment 12
Approach 12
Alt-Svc header parsing 12
Base64 encoding and decoding 13
DoH decoding 13
Escape 14
Date parsing 14
Expanding HSTS and Alt-Svc coverage 14
Expanding file-related and authentication-related fuzzing coverage 15
Strategic fuzzing recommendations 16
Codebase Maturity Evaluation 17
Summary of Findings 20
Detailed Findings 22
1. Bad recommendation in libcurl cookie documentation 22
Trail of Bits 3 cURL Security Assessment
PUBLIC
2. Libcurl URI parser accepts invalid characters 23
3. libcurl Alt-Svc parser accepts invalid port numbers 25
4. Non-constant-time comparison of secrets 27
5. Tab injection in cookie file 29
6. Standard output/input/error may not be opened 31
7. Double free when using HTTP proxy with specific protocols 32
8. Some flags override previous instances of themselves 35
9. Cookies are not stripped after redirect 36
10. Use after free while using parallel option and sequences 37
11. Unused memory blocks are not freed resulting in memory leaks 40
12. Referer header is generated in insecure manner 42
13. Redirect to localhost and local network is possible (Server-side request forgery
like) 43
14. URL parsing from redirect is incorrect when no path separator is provided 44
Summary of Recommendations 47
A. Vulnerability Categories 48
B. Code Maturity Categories 50
C. Code Quality Recommendations 52
D. HSTS debug patch 53
E. Fix Review Results 54
Detailed Fix Review Results 56
Trail of Bits 4 cURL Security Assessment
PUBLIC
Executive Summary
Engagement Overview
The Linux Foundation, via OpenSSF and strategic partner Open Source Technology
Improvement Fund, engaged Trail of Bits to review the security of cURL. From September
12 to October 7, 2022, a team of four Trail of Bits consultants conducted a security review
of the client-provided source code, with five and a half engineer-weeks of effort. Since this
project coincided with a Trail of Bits Maker Week, six additional people contributed five
additional days of effort. Details of the project’s timeline, test targets, and coverage are
provided in subsequent sections of this report.
Project Scope
Our testing efforts were focused on the identification of flaws that could result in a
compromise of confidentiality, integrity, or availability of the target system. We conducted
this audit with full knowledge of the system. We had access to the cURL source code,
documentation, and fuzzing harnesses. We performed static and dynamic automated and
manual testing of the target system and its codebase, using both automated and manual
processes.
Summary of Findings
The audit uncovered a small number of significant flaws that could impact system
confidentiality, integrity, or availability. A summary of the findings and details on notable
findings are provided below.
EXPOSURE ANALYSIS CATEGORY BREAKDOWN
Severity Count Category Count
High 2 Configuration 4
Low 5 Cryptography 1
Informational 6 Data Validation 8
Undetermined 2 Denial of Service 1
Undefined Behavior 1
Trail of Bits 5 cURL Security Assessment
PUBLIC
Notable Findings
Significant flaws that impact system confidentiality, integrity, or availability are listed below.
● TOB-CURL-7: Double free when using HTTP proxy with specific protocols
A double free occurs during connection cleanup when cURL (or libcurl) makes a
connection through a proxy.
● TOB-CURL-10: Use after free while using parallel option and sequences
Using cURL in parallel mode (-Z) with two consecutive sequences followed by an
empty bracket results in a use after free.
Trail of Bits 6 cURL Security Assessment
PUBLIC
Project Summary
Contact Information
The following managers were associated with this project:
Dan Guido , Account Manager Mary O’Brien , Project Manager
dan@trailofbits.com mary.obrien@trailofbits.com
Derek Zimmer , Program Manager Amir Montazery , Program Manager
derek@ostif.org amir@ostif.org
The following engineers were associated with this project:
Spencer Michaels , Consultant Emilio López , Consultant
spencer.michaels@trailofbits.com emilio.lopez@trailofbits.com
Anders Helsing , Consultant Paweł Płatek , Consultant
anders.helsing @trailofbits.com pawel.platek @trailofbits.com
Project Timeline
The significant events and milestones of the proje