daniel:// stenberg:// @bagder@mastodon.social
Public

one of the most common security reports we get in is claims of various CRLF injections where a user injects a CRLF into their own command lines and that's apparently "an attack".

We have documented this risk if you pass in junk in curl options but that doesn't stop the reporters from reporting this to us. Over and over.

Here's a recent one.

hackerone.com/reports/3418616

curl disclosed on HackerOne: SMTP CRLF Injection in curl/libcurl...

SMTP CRLF Injection Vulnerability in curl/libcurl ## Vulnerability ID: CURL-SMTP-CRLF-2024 ## CWE-93: Improper Neutralization of CRLF Sequences ### Executive Summary curl/libcurl contains a CRLF injection vulnerability in its SMTP implementation that allows attackers to inject arbitrary SMTP commands by including CR (\r) and LF (\n) characters in mailbox addresses. ### Affected Versions -...

hackerone.com · HackerOne

0
0
0

If you have a fediverse account, you can quote this note from your own instance. Search https://mastodon.social/users/bagder/statuses/115526203522250053 on your instance and quote it. (Note that quoting is not supported in Mastodon.)