Examples / Report #2917232 Saved analysis

CVE-2025-0167: netrc and default credential leak

curl · 2024-12-3012.7s analysis · $0.011 in model calls

What the report claims

The fix for CVE-2024-11053 seems to be incomplete, leading to sensitive information disclosure when netrc is used without providing user and password for a host.

Compare with curl's recorded outcome

Known vulnerability

A real vulnerability: CVE-2025-0167 netrc and default credential leak

Shown for comparison after analysis. The pipeline did not see this label.

ProveIt's finding

Needs human review

The available evidence does not settle the report. A maintainer should investigate.

Why this finding?

The provided source code does not include netrc parsing (likely lib/netrc.c), credential selection logic, or test479
CVE-2024-11053 fix cannot be evaluated without seeing the relevant code changes
The report describes a plausible credential leakage scenario (default netrc entry used for unrelated hosts) but the code path cannot be verified
External source E1 discusses CVE-2024-2398, not CVE-2024-11053, and does not address the netrc claim

What still needs checking

lib/netrc.c or equivalent netrc parsing implementation
Credential lookup/selection code that uses netrc data
test479 test case source
The actual fix for CVE-2024-11053 (commit or patch)

How this analysis ran 5 claims · 0 citations verified

Checked against curl master on 2024-12-30 (8a66c11a298c). Dev evaluation split. Citation verification checks that a referenced line was in the evidence; it does not prove the model interpreted it correctly.

1 · Grounding

grounded

no model · 2 references checked out, 0 did not

2 · Claims

NVIDIA-Nemotron-3-Nano-30B-A3B

5 claims · 1263 tokens · $0.0002

3 · Evidence

2 code snippets

real curl source at 8a66c11a298c · 1 docs via Tavily

4 · Judgment

Nemotron-3-Ultra-550b-a55b

6892 tokens · 10.0s · $0.0106

5 · Receipts

0 of 0 citations verified

every citation must point at code the judge was shown

Review a draft reply to the reporter

Edit and verify before sending.

Thank you for the report. The provided code snippets do not include the netrc parsing logic or credential selection code needed to evaluate this claim. Could you point to the specific file/function where netrc credentials are matched to connections (e.g., lib/netrc.c or the credential lookup in lib/url.c)? Also, if you have a link to the CVE-2024-11053 fix, that would help us compare the intended fix against the current behavior.

Inspect all claims and source code 5 claims · 2 code excerpts

Report claims

C1flaw not verifiable

Incomplete fix for CVE-2024-11053 results in netrc credential leakage

Read the reasoning

The provided code snippets (include/curl/curl.h and lib/urldata.h) do not contain netrc parsing logic, credential selection code, or the fix for CVE-2024-11053. The claim references CURLOPT_NETRC and CURLcode but the relevant implementation is not in the provided files.

C2location not verifiable

The issue occurs when using netrc in step1 without providing user and password for b.com

Read the reasoning

test479 is referenced but not provided in the source code. The netrc credential selection behavior for hosts without explicit credentials cannot be evaluated without the netrc parsing and credential lookup code.

C3trigger not verifiable

Using netrc configuration where both user and password are not provided for a host

Read the reasoning

The netrc configuration format (machine, login, password, default) is described but the parsing and credential matching logic is not in the provided code snippets.

C4impact not verifiable

Sensitive information disclosure

Read the reasoning

The impact claim depends on the credential leakage being real, which cannot be verified without the relevant code.

C5reproduction not verifiable

Adapt test479 to use netrc as described and run the test; it fails because alice and alicespassword are used for b.com

Read the reasoning

The reproduction steps reference test479 and netrc adaptation, but neither the test nor the netrc handling code is provided.

What the report says about other projects

not addressed The fix for CVE-2024-11053 seems to be incomplete

Read the original report

Full report on HackerOne ↗

## Summary: The fix for CVE-2024-11053 seems to be incomplete.The information leak problem could be reproduced again if use netrc in step1. ## Affected version all ## Steps To Reproduce: 1. Adapt test479 to use netrc like below(both of user and password are not provided for b.com): machine a.com login alice password alicespassword default 2.Run test479 3. The test would fail because alice and alicepassword were used for b.com. I used the latest version curl 8.11.1 but the problem still exists.I'm not sure if this is expected.Please point it out if i'm wrong. ## Impact ## Summary: Sensitive information disclosure.

Source code

include/curl/curl.hlines 776–797 · definition of CURLcode

            
              
                776typedef CURLcode (*curl_ssl_ctx_callback)(CURL *curl,    /* easy handle */
                                        void *ssl_ctx, /* actually an OpenSSL
                                                          or wolfSSL SSL_CTX,
                                                          or an mbedTLS
                                                        mbedtls_ssl_config */
                                        void *userptr);
782
783typedef enum {
CURLPROXY_HTTP = 0,   /* added in 7.10, new in 7.19.4 default is to use
                         CONNECT HTTP/1.1 */
CURLPROXY_HTTP_1_0 = 1,   /* added in 7.19.4, force to use CONNECT
                             HTTP/1.0  */
CURLPROXY_HTTPS = 2,  /* HTTPS but stick to HTTP/1 added in 7.52.0 */
CURLPROXY_HTTPS2 = 3, /* HTTPS and attempt HTTP/2 added in 8.2.0 */
CURLPROXY_SOCKS4 = 4, /* support added in 7.15.2, enum existed already
                         in 7.10 */
CURLPROXY_SOCKS5 = 5, /* added in 7.10 */
CURLPROXY_SOCKS4A = 6, /* added in 7.18.0 */
CURLPROXY_SOCKS5_HOSTNAME = 7 /* Use the SOCKS5 protocol but pass along the
                                 hostname rather than the IP address. added
                                 in 7.18.0 */
797} curl_proxytype;  /* this enum was added in 7.10 */

          

lib/urldata.h@curl-8_11_1lines 184–259 · definition of CURLcode as in release curl-8_11_1; differs from master

            
              
                184typedef CURLcode (*Curl_datastream)(struct Curl_easy *data,
185                                    struct connectdata *conn,
186                                    int *didwhat,
187                                    int select_res);
188#endif
189
190#include "mime.h"
191#include "imap.h"
192#include "pop3.h"
193#include "smtp.h"
194#include "ftp.h"
195#include "file.h"
196#include "vssh/ssh.h"
197#include "http.h"
198#include "rtsp.h"
199#include "smb.h"
200#include "mqtt.h"
201#include "ftplistparser.h"
202#include "multihandle.h"
203#include "c-hyper.h"
204#include "cf-socket.h"
205
206#ifdef HAVE_GSSAPI
207# ifdef HAVE_GSSGNU
208#  include <gss.h>
209# elif defined HAVE_GSSAPI_GSSAPI_H
210#  include <gssapi/gssapi.h>
211# else
212#  include <gssapi.h>
213# endif
214# ifdef HAVE_GSSAPI_GSSAPI_GENERIC_H
215#  include <gssapi/gssapi_generic.h>
216# endif
217#endif
218
219#ifdef USE_LIBSSH2
220#include <libssh2.h>
221#include <libssh2_sftp.h>
222#endif /* USE_LIBSSH2 */
223
224#define READBUFFER_SIZE CURL_MAX_WRITE_SIZE
225#define READBUFFER_MAX  CURL_MAX_READ_SIZE
226#define READBUFFER_MIN  1024
227
228/* The default upload buffer size, should not be smaller than
229   CURL_MAX_WRITE_SIZE, as it needs to hold a full buffer as could be sent in
230   a write callback.
231
232   The size was 16KB for many years but was bumped to 64KB because it makes
233   libcurl able to do significantly faster uploads in some circumstances. Even
234   larger buffers can help further, but this is deemed a fair memory/speed
235   compromise. */
236#define UPLOADBUFFER_DEFAULT 65536
237#define UPLOADBUFFER_MAX (2*1024*1024)
238#define UPLOADBUFFER_MIN CURL_MAX_WRITE_SIZE
239
240#define CURLEASY_MAGIC_NUMBER 0xc0dedbadU
241#ifdef DEBUGBUILD
242/* On a debug build, we want to fail hard on easy handles that
243 * are not NULL, but no longer have the MAGIC touch. This gives
244 * us early warning on things only discovered by valgrind otherwise. */
245#define GOOD_EASY_HANDLE(x) \
246  (((x) && ((x)->magic == CURLEASY_MAGIC_NUMBER))? TRUE: \
247  (DEBUGASSERT(!(x)), FALSE))
248#else
249#define GOOD_EASY_HANDLE(x) \
250  ((x) && ((x)->magic == CURLEASY_MAGIC_NUMBER))
251#endif
252
253#ifdef HAVE_GSSAPI
254/* Types needed for krb5-ftp connections */
255struct krb5buffer {
256  struct dynbuf buf;
257  size_t index;
258  BIT(eof_flag);
259};

          

776	typedef CURLcode (curl_ssl_ctx_callback)(CURL curl, /* easy handle */
777	void ssl_ctx, / actually an OpenSSL
778	or wolfSSL SSL_CTX,
779	or an mbedTLS
780	mbedtls_ssl_config */
781	void *userptr);
782
783	typedef enum {
784	CURLPROXY_HTTP = 0, /* added in 7.10, new in 7.19.4 default is to use
785	CONNECT HTTP/1.1 */
786	CURLPROXY_HTTP_1_0 = 1, /* added in 7.19.4, force to use CONNECT
787	HTTP/1.0 */
788	CURLPROXY_HTTPS = 2, /* HTTPS but stick to HTTP/1 added in 7.52.0 */
789	CURLPROXY_HTTPS2 = 3, /* HTTPS and attempt HTTP/2 added in 8.2.0 */
790	CURLPROXY_SOCKS4 = 4, /* support added in 7.15.2, enum existed already
791	in 7.10 */
792	CURLPROXY_SOCKS5 = 5, /* added in 7.10 */
793	CURLPROXY_SOCKS4A = 6, /* added in 7.18.0 */
794	CURLPROXY_SOCKS5_HOSTNAME = 7 /* Use the SOCKS5 protocol but pass along the
795	hostname rather than the IP address. added
796	in 7.18.0 */
797	} curl_proxytype; /* this enum was added in 7.10 */

184	typedef CURLcode (Curl_datastream)(struct Curl_easy data,
185	struct connectdata *conn,
186	int *didwhat,
187	int select_res);
188	#endif
189
190	#include "mime.h"
191	#include "imap.h"
192	#include "pop3.h"
193	#include "smtp.h"
194	#include "ftp.h"
195	#include "file.h"
196	#include "vssh/ssh.h"
197	#include "http.h"
198	#include "rtsp.h"
199	#include "smb.h"
200	#include "mqtt.h"
201	#include "ftplistparser.h"
202	#include "multihandle.h"
203	#include "c-hyper.h"
204	#include "cf-socket.h"
205
206	#ifdef HAVE_GSSAPI
207	# ifdef HAVE_GSSGNU
208	# include <gss.h>
209	# elif defined HAVE_GSSAPI_GSSAPI_H
210	# include <gssapi/gssapi.h>
211	# else
212	# include <gssapi.h>
213	# endif
214	# ifdef HAVE_GSSAPI_GSSAPI_GENERIC_H
215	# include <gssapi/gssapi_generic.h>
216	# endif
217	#endif
218
219	#ifdef USE_LIBSSH2
220	#include <libssh2.h>
221	#include <libssh2_sftp.h>
222	#endif /* USE_LIBSSH2 */
223
224	#define READBUFFER_SIZE CURL_MAX_WRITE_SIZE
225	#define READBUFFER_MAX CURL_MAX_READ_SIZE
226	#define READBUFFER_MIN 1024
227
228	/* The default upload buffer size, should not be smaller than
229	CURL_MAX_WRITE_SIZE, as it needs to hold a full buffer as could be sent in
230	a write callback.
231
232	The size was 16KB for many years but was bumped to 64KB because it makes
233	libcurl able to do significantly faster uploads in some circumstances. Even
234	larger buffers can help further, but this is deemed a fair memory/speed
235	compromise. */
236	#define UPLOADBUFFER_DEFAULT 65536
237	#define UPLOADBUFFER_MAX (210241024)
238	#define UPLOADBUFFER_MIN CURL_MAX_WRITE_SIZE
239
240	#define CURLEASY_MAGIC_NUMBER 0xc0dedbadU
241	#ifdef DEBUGBUILD
242	/* On a debug build, we want to fail hard on easy handles that
243	* are not NULL, but no longer have the MAGIC touch. This gives
244	* us early warning on things only discovered by valgrind otherwise. */
245	#define GOOD_EASY_HANDLE(x) \
246	(((x) && ((x)->magic == CURLEASY_MAGIC_NUMBER))? TRUE: \
247	(DEBUGASSERT(!(x)), FALSE))
248	#else
249	#define GOOD_EASY_HANDLE(x) \
250	((x) && ((x)->magic == CURLEASY_MAGIC_NUMBER))
251	#endif
252
253	#ifdef HAVE_GSSAPI
254	/* Types needed for krb5-ftp connections */
255	struct krb5buffer {
256	struct dynbuf buf;
257	size_t index;
258	BIT(eof_flag);
259	};