Examples / Report #1891474 Saved analysis

CVE-2023-27533: Telnet option IAC injection

curl · 2023-03-038.1s analysis · $0.008 in model calls

What the report claims

CURLOPT_TELNETOPTIONS allows setting telnet options, but missing encoding of IAC (0xff) enables injection of arbitrary TELNET commands via TTYPE, XDISPLOC, or NEW_ENV options.

Compare with curl's recorded outcome

Known vulnerability

A real vulnerability: CVE-2023-27533 TELNET option IAC injection

Shown for comparison after analysis. The pipeline did not see this label.

ProveIt's finding

Needs human review

The available evidence does not settle the report. A maintainer should investigate.

Why this finding?

No curl source code was provided for the telnet option handling (CURLOPT_TELNETOPTIONS implementation), so the central claim about missing IAC encoding cannot be verified or contradicted.
The reproduction case with tcpdump output suggests plausible injection behavior (0xff 0xf0 sequence visible in packet capture), but the code path is not available for analysis.
RFC 854 excerpt provided does not contain the referenced 'TELNET COMMAND STRUCTURE' section.

What still needs checking

curl source code for telnet option handling (likely in lib/telnet.c or similar) at revision ad4997e5b289
Specifically the code that constructs suboption data for TTYPE, XDISPLOC, and NEW_ENV options

How this analysis ran 5 claims · 0 citations verified

Checked against curl master on 2023-03-03 (ad4997e5b289). Test evaluation split. Citation verification checks that a referenced line was in the evidence; it does not prove the model interpreted it correctly.

1 · Grounding

grounded

no model · 5 references checked out, 0 did not

2 · Claims

NVIDIA-Nemotron-3-Nano-30B-A3B

5 claims · 1808 tokens · $0.0002

3 · Evidence

0 code snippets

real curl source at ad4997e5b289 · 3 docs via Tavily

4 · Judgment

Nemotron-3-Ultra-550b-a55b

4771 tokens · 5.1s · $0.0074

5 · Receipts

0 of 0 citations verified

every citation must point at code the judge was shown

Review a draft reply to the reporter

Edit and verify before sending.

Thank you for the detailed report with reproduction steps and packet capture. To assess this, we need to examine curl's telnet option handling code (CURLOPT_TELNETOPTIONS implementation) at the relevant revision. Could you point to the specific file/function where telnet suboption data is constructed? The packet capture showing 0xff 0xf0 injection is concerning, but we need to verify the code path.

Inspect all claims and source code 5 claims · 0 code excerpts

Report claims

C1flaw not verifiable

Missing encoding of "Interpret as Command" IAC (0xff) character when constructing suboption data for telnet options

Read the reasoning

No curl source code was provided to examine the telnet option handling implementation. The deterministic checks only confirm symbols exist, not how IAC encoding is handled.

C2location not verifiable

In curl's telnet option handling code

Read the reasoning

No curl source code was provided to locate the telnet option handling code.

C3trigger not verifiable

Attacker controls TTYPE, XDISPLOC, or NEW_ENV option values via CURLOPT_TELNETOPTIONS

Read the reasoning

No curl source code was provided to verify how CURLOPT_TELNETOPTIONS processes TTYPE, XDISPLOC, and NEW_ENV values.

C4impact not verifiable

Escape out of telnet subnegotiation and inject arbitrary TELNET commands

Read the reasoning

The external source E1 (RFC 854) excerpt provided does not contain the 'TELNET COMMAND STRUCTURE' content referenced in the claim. No curl code was provided to verify the injection path.

C5reproduction not verifiable

Use curl --telnet-option NEW_ENV=a,b$(echo -ne "\xff\xf0INJECTED") telnet://server to inject commands

Read the reasoning

The reproduction steps are described but cannot be verified against curl's implementation without the source code.

What the report says about other projects

not addressed TELNET command refers to 'TELNET COMMAND STRUCTURE' in RFC 854

Read the original report

Full report on HackerOne ↗

## Summary: `CURLOPT_TELNETOPTIONS` allows setting various telnet options for telnet protocol. Due to missing encoding of "Interpret as Command" `IAC` (0xff) character, the attacker who can control these option values can escape out of the telnet subnegotiation and enter arbitrary TELNET commands (*) via the `CURLOPT_TELNETOPTIONS` options. `TTYPE`, `XDISPLOC` and `NEW_ENV` options are affected. *) TELNET command refers to "TELNET COMMAND STRUCTURE" in RFC 854 ## Steps To Reproduce: 1. `curl --telnet-option NEW_ENV=a,b$(echo -ne "\xff\xf0INJECTED") telnet://server` When inspected with tcpdump: ``` 20:57:34.454720 IP x.x.x.x.53864 > y.y.y.y.telnet: Flags [P.], seq 17:37, ack 22, win 2058, options [nop,nop,TS val 1459077881 ecr 3403052525], length 20 [telnet SB NEW-ENVIRON IS 0 0x61 0x1 0x62 SE] 0x0000: 4502 0048 0000 4000 4006 265a XXXX XXXX E..H..@.@.&ZXXXX 0x0010: YYYY YYYY d268 0017 12a4 daa2 6603 9cb6 YYYY.h......f... 0x0020: 8018 080a f840 0000 0101 080a 56f7 c2f9 .....@......V... 0x0030: cad6 75ed fffa 2700 0061 0162 fff0 494e ..u...'..a.b..IN 0x0040: 4a45 4354 4544 fff0 JECTED.. ``` ## Remediation - Double encode "Interpret as Command" (`IAC`) (0xff) if it is encountered when constructing the suboption data to be sent. ## Supporting Material/References: * RFC 854 - https://www.rfc-editor.org/rfc/rfc854 ## Impact Attacker being able to specify `TTYPE`, `XDISPLOC` or `NEW_ENV` values is able to inject unintended TELNET commands to the telnet connection. Depending on the use case of the telnet protocol, this may allow the attacker to inject commands or other controlling operations. The practical impact is context specific, but in worst case this could for example allow executing arbitrary OS commands on target system.

Source code

No source code was retrieved for this analysis. The evidence may be incomplete.