✓ProveIt
Examples / Report #1813864 Saved analysis

CVE-2023-23914: curl HSTS ignored on multiple requests

curl · 2022-12-215.5s analysis · $0.004 in model calls

What the report claims

curl tool HSTS doesn't work correctly when performing multiple requests within a single invocation.

Compare with curl's recorded outcome

Known vulnerability

A real vulnerability: CVE-2023-23914 HSTS ignored on multiple requests

Shown for comparison after analysis. The pipeline did not see this label.

ProveIt's finding

More detail needed

There is not enough information to verify the reported bug.

Why this finding?
  • No curl source code was retrieved for the target revision c12fb3ddaf48 (master on 2022-12-21)
  • All claims require examination of the HSTS implementation and multi-request handling code, which is not available
  • The deterministic checks returned 'nothing_to_check', indicating no code was available for analysis
What still needs checking
  • curl source code for revision c12fb3ddaf48, particularly the HSTS handling code and the multi-request execution logic
How this analysis ran 5 claims · 0 citations verified

Checked against curl master on 2022-12-21 (c12fb3ddaf48). Dev evaluation split. Citation verification checks that a referenced line was in the evidence; it does not prove the model interpreted it correctly.

1 · Grounding
nothing to check
no model · 0 references checked out, 0 did not
2 · Claims
NVIDIA-Nemotron-3-Nano-30B-A3B
5 claims · 996 tokens · $0.0001
3 · Evidence
0 code snippets
real curl source at c12fb3ddaf48
4 · Judgment
Nemotron-3-Ultra-550b-a55b
2311 tokens · 4.1s · $0.0040
5 · Receipts
0 of 0 citations verified
every citation must point at code the judge was shown
Review a draft reply to the reporter

Edit and verify before sending.

Thank you for the report. To assess this HSTS issue, we need to examine the curl source code at the relevant revision. Could you provide the specific version or commit you tested against, or point us to the HSTS implementation files (likely in lib/ or src/tool_*) so we can verify the multi-request behavior?

Inspect all claims and source code 5 claims · 0 code excerpts

Report claims

C1flaw not verifiable

curl ignores HSTS on subsequent requests when multiple requests are made in a single invocation

Read the reasoning

No curl source code was provided for the revision c12fb3ddaf48. The claim that curl ignores HSTS on subsequent requests cannot be verified against the actual implementation.

C2location not verifiable

in the curl code that handles HSTS

Read the reasoning

No curl source code was provided. The location of the HSTS handling code cannot be identified or examined.

C3trigger not verifiable

when performing multiple requests within a single curl invocation

Read the reasoning

No curl source code was provided. The code path for multiple requests in a single invocation cannot be traced.

C4impact not verifiable

the second request will be performed over HTTP regardless of the correct HSTS header

Read the reasoning

No curl source code was provided. The behavior of the second request cannot be verified against the implementation.

C5reproduction not verifiable

using the command `curl --hsts "" https://hsts.example.com http://hsts.example.com`

Read the reasoning

The reproduction command is provided, but without the curl source code, it cannot be determined whether this command would trigger the described behavior.

Read the original report

Full report on HackerOne ↗

## Summary: curl tool HSTS doesn't work correctly when performing multiple requests within a single invocation. ## Steps To Reproduce: 1. `curl --hsts "" https://hsts.example.com http://hsts.example.com` The second request will be performed over HTTP regardless if correct HSTS header is returned by the first request. ## Impact Request performed over insecure channels unexpectedly and loss of confidentiality and integrity.

Source code

No source code was retrieved for this analysis. The evidence may be incomplete.