✓ProveIt
Examples / Report #1730660 Saved analysis

CVE-2022-42916: HSTS bypass via IDN

curl · 2022-10-118.7s analysis · $0.009 in model calls

What the report claims

HSTS bypass via IDN conversion where a character converts to '.' causing HSTS checks to fail.

Compare with curl's recorded outcome

Known vulnerability

A real vulnerability: CVE-2022-42916 HSTS bypass via IDN

Shown for comparison after analysis. The pipeline did not see this label.

ProveIt's finding

Needs human review

The available evidence does not settle the report. A maintainer should investigate.

Why this finding?
  • No curl source code was provided for the target revision (29c4aa00a168) to evaluate HSTS cache lookup or IDN conversion.
  • The deterministic check only confirms a 'convert' symbol exists, not its semantics or interaction with HSTS.
  • The report provides a concrete reproduction case and plausible mechanism, but the automated assessment lacks the code to confirm or refute it.
What still needs checking
  • curl source files handling HSTS cache (likely lib/hsts.c) and IDN conversion (likely lib/idn.c or similar) at revision 29c4aa00a168
How this analysis ran 5 claims · 0 citations verified

Checked against curl master on 2022-10-11 (29c4aa00a168). Test evaluation split. Citation verification checks that a referenced line was in the evidence; it does not prove the model interpreted it correctly.

1 · Grounding
grounded
no model · 2 references checked out, 0 did not
2 · Claims
NVIDIA-Nemotron-3-Nano-30B-A3B
5 claims · 2509 tokens · $0.0002
3 · Evidence
0 code snippets
real curl source at 29c4aa00a168
4 · Judgment
Nemotron-3-Ultra-550b-a55b
4809 tokens · 6.5s · $0.0084
5 · Receipts
0 of 0 citations verified
every citation must point at code the judge was shown
Review a draft reply to the reporter

Edit and verify before sending.

Thank you for the detailed report. To triage this, we need to examine the HSTS cache lookup and IDN conversion code in curl at the version you tested (7.85.0). Could you confirm the exact curl commit or release tag you used? The automated check could not retrieve the relevant source files for revision 29c4aa00a168. A maintainer will review the HSTS and IDN code paths manually.

Inspect all claims and source code 5 claims · 0 code excerpts

Report claims

C1flaw not verifiable

HSTS checks are bypassed if any character in the IDN convert(Nameprep) to a '.'

Read the reasoning

No curl source code provided to examine HSTS implementation or IDN conversion logic. The deterministic check only confirms a 'convert' symbol exists, not its behavior.

C2location not verifiable

in the IDN conversion process

Read the reasoning

Location claim depends on code not provided.

C3trigger not verifiable

a character that converts to '.' via IDN conversion

Read the reasoning

Trigger claim depends on IDN conversion behavior not shown in provided context.

C4impact not verifiable

HSTS bypass allowing HTTP to HTTPS downgrade or plaintext HTTP

Read the reasoning

Impact claim cannot be verified without HSTS cache lookup code.

C5reproduction not verifiable

using curl with an IDN containing a character that converts to '.' in Nameprep

Read the reasoning

Reproduction command given but cannot be tested against provided code (none).

Read the original report (excerpt)

Full report on HackerOne ↗

## Summary: HSTS checks are bypassed if any character in the IDN convert(Nameprep) to a '.' for example"。"(UTF-8:E38082). I think there are other characters that become ".(UTF-8:2E)" as a result of converting with IDN. '。(UTF-8:E38082)' is converted to '.' so it doesn't matter if it's last or not. So the same thing happens with "http://accounts.google.com。" as well as "http://accounts.google。com". ## Steps To Reproduce: `curl -v --hsts hsts.txt http://accounts.google.com。` I prepared "test.sh" because I was worried about whether I could try it in an environment without Japanese fonts. The character encoding is UTF-8. hsts:txt: ``` # Your HSTS cache. https://curl.se/docs/hsts.html # This file was generated by libcurl! Edit at your own risk. .accounts.google.com "20231011 14:44:21" ``` The results of the execution are shown below. IDN When not converting: ``` # curl -v --hsts hsts.txt http://accounts.google.com * Switched from HTTP to HTTPS due to HSTS => https://accounts.google.com/ * Trying 142.250.196.141:443... * Connected to accounts.google.com (142.250.196.141) port 443 (#0) * ALPN: offers h2 * ALPN: offers http/1.1 * CAfile: /etc/ssl/certs/ca-certificates.crt * CApath: /etc/ssl/certs * TLSv1.0 (OUT), TLS header, Certificate Status (22): * TLSv1.3 (OUT), TLS handshake, Client hello (1): * TLSv1.2 (IN), TLS header, Certificate Status (22): * TLSv1.3 (IN), TLS handshake, Server hello (2): * TLSv1.2 (IN), TLS header, Finished (20): * TLSv1.2 (IN), TLS header, Supplemental data (23): * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): * TLSv1.3 (IN), TLS handshake, Certificate (11): * TLSv1.3 (IN), TLS handshake, CERT verify (15): * TLSv1.3 (IN), TLS handshake, Finished (20): * TLSv1.2 (OUT), TLS header, Finished (20): * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): * TLSv1.2 (OUT), TLS header, Supplemental data (23): * TLSv1.3 (OUT), TLS handshake, Finished (20): * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 * ALPN: server accepted h2 * Server certificate: * subject: CN=accounts.google.com * start date: Sep 12 08:19:34 2022 GMT * expire date: Dec 5 08:19:33 2022 GMT * subjectAltName: host "accounts.google.com" matched cert's "accounts.google.com" * issuer: C=US; O=Google Trust Services LLC; CN=GTS CA 1C3 * SSL certificate verify ok. * Using HTTP2, server supports multiplexing * Copying HTTP/2 data in stream buffer …

Source code

No source code was retrieved for this analysis. The evidence may be incomplete.