✓ProveIt
Examples / Report #1895135 Saved analysis

CVE-2023-27536: GSS delegation too eager connection re-use

curl · 2023-03-079.3s analysis · $0.009 in model calls

What the report claims

When reusing connections, curl does not consider CURLOPT_GSSAPI_DELEGATION settings, leading to reuse of connections that should not be reused.

Compare with curl's recorded outcome

Known vulnerability

A real vulnerability: CVE-2023-27536 GSS delegation too eager connection reuse

Shown for comparison after analysis. The pipeline did not see this label.

ProveIt's finding

Needs human review

The available evidence does not settle the report. A maintainer should investigate.

Why this finding?
  • The critical connection reuse logic in libcurl (where CURLOPT_GSSAPI_DELEGATION would need to be checked) is not included in the provided source code
  • Only the tool-side parameter parsing for --delegation is shown (src/tool_paramhlp.c:588-601)
  • The claim is plausible given that delegation options exist and connection reuse is a known curl feature, but cannot be confirmed without seeing the conncache/connection reuse implementation
  • Deterministic check only confirms CURLOPT_GSSAPI_DELEGATION symbol exists, not how it's used in connection matching
What still needs checking
  • libcurl connection reuse/cache implementation (likely lib/conncache.c or similar)
  • Where CURLOPT_GSSAPI_DELEGATION is stored in the connection data structure
  • The connection comparison/matching logic that decides reuse eligibility
How this analysis ran 5 claims · 3 citations verified

Checked against curl master on 2023-03-07 (6466071e8e85). Test evaluation split. Citation verification checks that a referenced line was in the evidence; it does not prove the model interpreted it correctly.

1 · Grounding
grounded
no model · 1 references checked out, 0 did not
2 · Claims
NVIDIA-Nemotron-3-Nano-30B-A3B
5 claims · 1305 tokens · $0.0002
3 · Evidence
1 code snippets
real curl source at 6466071e8e85 · 2 docs via Tavily
4 · Judgment
Nemotron-3-Ultra-550b-a55b
5549 tokens · 7.1s · $0.0090
5 · Receipts
3 of 3 citations verified
every citation must point at code the judge was shown
Review a draft reply to the reporter

Edit and verify before sending.

Thank you for the report. The provided code shows the --delegation option parsing (src/tool_paramhlp.c:588-601) but not the libcurl connection reuse logic that would need to compare CURLOPT_GSSAPI_DELEGATION values. To assess this, we need to see the connection cache implementation (likely in lib/conncache.c) where connections are matched for reuse. Could you point to the specific file/function where connection reuse decisions are made, or provide a patch showing where the delegation check should be added?

Inspect all claims and source code 5 claims · 1 code excerpts

Report claims

C1flaw not verifiable

curl reuses connections without checking CURLOPT_GSSAPI_DELEGATION differences

Read the reasoning

The central claim is that connection reuse logic doesn't check CURLOPT_GSSAPI_DELEGATION. The provided source only shows the command-line parameter parsing for --delegation (lines 588-601). The actual connection reuse logic in libcurl (likely in lib/conncache.c or similar) is not included in the provided code, so the claim cannot be verified or contradicted from the given evidence.

src/tool_paramhlp.c:588
C2location not verifiable

connection reuse logic in libcurl

Read the reasoning

The claim references 'connection reuse logic in libcurl' but no libcurl connection reuse source files are provided in the curl_source section. Only tool-side parameter handling is shown.

C3trigger supported

using different delegation settings in successive requests

Read the reasoning

The provided code confirms that different delegation settings ('none', 'policy', 'always') can be specified via --delegation and are translated to distinct CURLGSSAPI_DELEGATION_* values, making the trigger scenario plausible.

src/tool_paramhlp.c:588
C4impact not verifiable

reuse of connections that should not be reused

Read the reasoning

Impact depends on C1 being true. Since the connection reuse logic is not provided, the impact cannot be verified.

C5reproduction supported

curl --negotiate -u : --delegation "always" https://server/path -: --negotiate -u : --delegation "none" https://server/path

Read the reasoning

The reproduction command uses --delegation with 'always' and 'none' which are valid options per the delegation() function shown in lines 588-601.

src/tool_paramhlp.c:588
Read the original report

Full report on HackerOne ↗

## Summary: When considering reuse of existing connections different `CURLOPT_GSSAPI_DELEGATION` (libcurl) `--delegation` (curl) option is not taken into consideration. This can lead to reuse of previously established connection when it should no longer be (as more strict or no delegation was requested). ## Steps To Reproduce: 1. `curl --negotiate -u : --delegation "always" https://server/path -: --negotiate -u : --delegation "none" https://server/path` ## Remediation - Safest option is to not reuse connections if different `CURLOPT_GSSAPI_DELEGATION` levels are being used. It **might** also be correct to not reuse connections with "laxer" `CURLOPT_GSSAPI_DELEGATION`: "none" should only allow reusing "none" level, "policy" should only allow "none" or "policy" level, while "always" can reuse all connections otherwise deemed appropriate for reuse. ## Impact Existing connection that was established via more lax delegation will be reused for connection that should not succeed due to more restrictive delegation requested. The practical impact can vary, but I believe it is likely quite low, as it should be quite rare to have connections attempted with mixed delegation policies like this.

Source code

src/tool_paramhlp.clines 588–601 · definition of delegation
588long delegation(struct OperationConfig *config, const char *str)
C1: Only shows delegation option parsing, not connection reuse logic
C3: Shows delegation() function parsing 'none', 'policy', 'always' into CURLGSSAPI_DELEGATION_* constants
C5: Confirms --delegation accepts 'always' and 'none' as valid arguments
589{
590 if(curl_strequal("none", str))
591 return CURLGSSAPI_DELEGATION_NONE;
592 if(curl_strequal("policy", str))
593 return CURLGSSAPI_DELEGATION_POLICY_FLAG;
594 if(curl_strequal("always", str))
595 return CURLGSSAPI_DELEGATION_FLAG;
596
597 warnf(config->global, "unrecognized delegation method '%s', using none\n",
598 str);
599
600 return CURLGSSAPI_DELEGATION_NONE;
601}