Penetration Test Report (TrailOfBits): 2022 12 curl threatmodel

cURL
Threat Model
December 13, 2022
Prepared for:
Daniel Stenberg, cURL
Open Source Security Foundation (OpenSSF)
Open Source Technology Improvement Fund
Prepared by: Alex Useche and Anders Helsing
About Trail of Bits
Founded in 2012 and headquartered in New York, Trail of Bits provides technical security
assessment and advisory services to some of the world’s most targeted organizations. We
combine high- end security research with a real -world attacker mentality to reduce risk and
fortify code. With 80+ employees around the globe, we’ve helped secure critical software
elements that support billions of end users, including Kubernetes and the Linux kernel.
We maintain an exhaustive list of publications at https://github.com/trailofbits/publications ,
with links to papers, presentations, public audit reports, and podcast appearances.
In recent years, Trail of Bits consultants have showcased cutting-edge research through
presentations at CanSecWest, HCSS, Devcon, Empire Hacking, GrrCon, LangSec, NorthSec,
the O’Reilly Security Conference, PyCon, REcon, Security BSides, and SummerCon.
We specialize in software testing and code review projects, supporting client organizations
in the technology, defense, and finance industries, as well as government entities. Notable
clients include HashiCorp, Google, Microsoft, Western Digital, and Zoom.
Trail of Bits also operates a center of excellence with regard to blockchain security. Notable
projects include audits of Algorand, Bitcoin SV, Chainlink, Compound, Ethereum 2.0,
MakerDAO, Matic, Uniswap, Web3, and Zcash.
To keep up to date with our latest news and announcements, please follow @trailofbits on
Twitter and explore our public repositories at https://github.com/trailofbits . To engage us
directly, visit our “Contact” page at https://www.trailofbits.com/contact , or email us at
info@trailofbits.com .
Trail of Bits, Inc.
228 Park Ave S #80688
New York, NY 10003
https://www.trailofbits.com
info@trailofbits.com
Trail of Bits 1 cURL Threat Model
PUBLIC
Notices and Remarks
Copyright and Distribution
© 2022 by Trail of Bits, Inc.
All rights reserved. Trail of Bits hereby asserts its right to be identified as the creator of this
report in the United Kingdom.
This report is considered by Trail of Bits to be public information; it is licensed to Linux
Foundation under the terms of the project statement of work and has been made public at
Linux Foundation’s request. Material within this report may not be reproduced or
distributed in part or in whole without the express written permission of Trail of Bits.
Analysis Coverage Disclaimer
All activities undertaken by Trail of Bits in association with this project were performed in
accordance with a statement of work and mutually agreed upon project plan.
Security assessment projects are time-boxed and often reliant on information that may be
provided by a client, its affiliates, or its partners. As such, the findings documented in this
report should not be considered a comprehensive list of security issues, flaws, or defects in
the target system or codebase.
Trail of Bits 2 cURL Threat Model
PUBLIC
Table of Contents
About Trail of Bits 1
Notices and Remarks 2
Table of Contents 2
Executive Summary 5
Project Summary 6
Project Coverage 7
System Diagrams 8
High-Level Data Flow 8
Binary Data Flow 9
Components 10
High-Level Breakdown 10
Binary Breakdown 11
Trust Zones 14
Trust Zone Connections 15
Connection Type and Authentication Breakdown 17
Threat Actors 19
Threat Actor Paths 20
Possible Attack Vectors 21
Summary of Recommendations 22
Summary of Findings 23
Detailed Findings 24
1. Proxy credentials are cached without encryption 24
Trail of Bits 3 cURL Threat Model
PUBLIC
2. Lack of support for MQTT over TLS 25
3. No warnings when TLS connection attempts fail with the --ssl flag 26
4. Contributing guidelines lack recommendations against using insecure C functions
27
5. cURL treats localhost as secure by default 28
6. Insufficient input validation strategy 29
7. Lack of documentation on supported protocol features and RFC compliance 30
A. Methodology 31
B. Security Controls and Rating Criteria 32
C. CVE Analysis 35
High-Level Analysis 39
CIA Triad Impact 39
Common CWEs 39
Common Concerns 40
D. Fix Review Results 41
Detailed Fix Review Results 42
Trail of Bits 4 cURL Threat Model
PUBLIC
Executive Summary
Engagement Overview
The Linux Foundation, via OpenSSF and strategic partner Open Source Technology
Improvement Fund, engaged Trail of Bits to conduct a component-focused threat model of
its cURL. From September 6 to October 7, 2022, a team of two consultants conducted a
threat model of cURL and libcurl. Details of the project’s timeline, test targets, and coverage
are provided in subsequent sections of this report.
Project Scope
Our assessment focused on the identification of security control flaws that could result in a
compromise of confidentiality, integrity, or availability of the target system, especially with
respect to the controls noted in the category breakdown table below. An exhaustive list of
security control types and their definitions can be found in Appendix B .
Summary of Findings
The audit uncovered one design-level issue that could lead to vulnerabilities that
compromise confidentiality, integrity, or availability of users and data handled by the
system under audit.
FINDINGS BY SEVERITY FINDINGS BY CONTROL TYPE
Severity Count Category Count
High 1 System and Information 1
Integrity
Medium 3
Awareness and Training 3
Informational 3
System and 1
Communications Protection
Audit and Accountability 1
Configuration Management 1
Trail of Bits 5 cURL Threat Model
PUBLIC
Project Summary
Contact Information
The following managers were associated with this project:
Dan Guido , Account Manager Mary O’Brien , Project Manager
dan@trailofbits.com mary.obrien@trailofbits.com
Derek Zimmer , Program Manager Amir Montazery , Program Manager
derek@ostif.org amir@ostif.org
The following engineers were associated with this project:
Alex Useche , Consultant Anders Helsing , Consultant
alex.useche@trailofbits.com anders.helsing@trailofbits.com
Project Timeline
The significant events and milestones of the project are listed below.
Date Event
September 2, 2022 Pre-project kickoff call
September 13, 2022 Status meeting #1
September 16, 2022 Interview meeting
September 20, 2022 Status meeting #2
September 27, 2022 Delivery of preliminary final report
October 11, 2022 Delivery of final report draft
December 13, 2022 Delivery of final report with fix review
Trail of Bits 6 cURL Threat Model
PUBLIC
Project Coverage
During a threat modeling assessment, engineers generally aim to cover the entire target
system as a coherent whole. In some cases, however, certain components may be either
unnecessary to examine, or impossible to review thoroughly.
Security Controls
The following security controls were used to evaluate the project targets during threat
modeling exercises. Further information regarding security controls can be observed within
Appendix B .
● Access Controls
● Audit and Accountability
● Awareness and Training
● Configuration Management
● Cryptography
● Denial of Service
● Identification and Authentication
● Risk Assessment
● System and Communications Protection
● System and Information Integrity
Limitations
Because of the time-boxed nature of testing work, it is common to encounter coverage
limitations. During this project, we focused on considering threats to cURL, including the
command-line utility and libcurl. However, because cURL supports a long list of protocols,
we chose not to treat each protocol implementation as a discrete component. As a result,
our review considers support for various protocols at a high level while focusing on core
components of cURL such as parsing, file input, output operations, and polling of
connections.
Trail of Bits 7 cURL Threat Model
PUBLIC
System Diagrams
The following diagrams depict the relationships between the target system’s various
compo