Examples / Report #3100073 Saved analysis

Path Traversal Vulnerability in curl via Unsanitized IPFS_PATH Environment Variable

curl · 2025-04-1813.4s analysis · $0.012 in model calls

What the report claims

IPFS_PATH environment variable is not properly sanitized, allowing directory traversal to read arbitrary files via curl's IPFS gateway.

Compare with curl's recorded outcome

Labeled AI slop

curl's maintainer lists this report as AI slop

Shown for comparison after analysis. The pipeline did not see this label.

ProveIt's finding

More detail needed

There is not enough information to verify the reported bug.

Why this finding?

No curl source code was provided for the revision in question (f6167049805f). The curl_source section explicitly states '(no curl code could be retrieved for this report)'.
All five claims depend on examining curl's IPFS gateway implementation, specifically how IPFS_PATH is read, validated, and used in filesystem operations.
The deterministic checks only confirm that realpath() exists somewhere in curl, not how it is (or isn't) applied to IPFS_PATH.
The external sources (E1, E2, E3) discuss path traversal in unrelated projects (ggen-core, glibc, patch/dpkg) and do not address curl's IPFS implementation.

What still needs checking

curl source files handling IPFS protocol, particularly the code that reads IPFS_PATH environment variable and uses it to locate gateway binaries or data
The specific file(s) implementing the 'ipfs://' URL scheme handler
Any path sanitization, validation, or realpath() calls applied to IPFS_PATH before filesystem access

How this analysis ran 5 claims · 0 citations verified

Checked against curl master on 2025-04-18 (f6167049805f). Test evaluation split. Citation verification checks that a referenced line was in the evidence; it does not prove the model interpreted it correctly.

1 · Grounding

grounded

no model · 2 references checked out, 0 did not

2 · Claims

NVIDIA-Nemotron-3-Nano-30B-A3B

5 claims · 2360 tokens · $0.0002

3 · Evidence

0 code snippets

real curl source at f6167049805f · 3 docs via Tavily

4 · Judgment

Nemotron-3-Ultra-550b-a55b

8241 tokens · 5.9s · $0.0117

5 · Receipts

0 of 0 citations verified

every citation must point at code the judge was shown

Review a draft reply to the reporter

Edit and verify before sending.

Thank you for the detailed report. To evaluate this, we need the curl source code that handles the IPFS protocol and the IPFS_PATH environment variable. The provided materials did not include any curl source files. Could you point us to the specific file(s) in the curl repository (e.g., lib/ipfs.c, lib/vipfs.c, or similar) where IPFS_PATH is read and used? With that code, we can check whether path traversal sequences are blocked and whether file contents can leak via error messages.

Inspect all claims and source code 5 claims · 0 code excerpts

Report claims

C1flaw not verifiable

IPFS_PATH environment variable is not properly sanitized

Read the reasoning

No curl source code was provided to examine how IPFS_PATH is read and used. The claim that it is 'not properly sanitized' cannot be verified or contradicted without seeing the relevant code paths.

C2location not verifiable

curl versions with IPFS support (7.81.0+)

Read the reasoning

The report states IPFS support was added in 7.81.0+, but no curl source code or version history was provided to confirm when IPFS support was introduced or which files handle it.

C3trigger not verifiable

manipulating directory traversal sequences (e.g., ../../../../etc)

Read the reasoning

The claim about directory traversal sequences (e.g., ../../../../etc) being usable depends on how curl processes the IPFS_PATH value. Without the curl code that joins or resolves this path, the claim cannot be assessed.

C4impact not verifiable

leakage of sensitive data (e.g., SSH keys, credentials, system files) via DNS/HTTP error messages

Read the reasoning

The claim that file contents leak via 'DNS/HTTP error messages' requires examining curl's error reporting code paths for IPFS. No such code was provided.

C5reproduction not verifiable

curl -v ipfs://dummycid 2>&1 | grep -A1 "Could not resolve host"

Read the reasoning

The reproduction command is provided, but without the curl source code handling the 'ipfs://' scheme and IPFS_PATH, there is no way to trace whether the described exploit path actually exists.

What the report says about other projects

not addressed The IPFS_PATH environment variable is not properly sanitized, allowing attackers to read arbitrary files by manipulating directory traversal sequences.

Read the original report (excerpt)

Full report on HackerOne ↗

A path traversal vulnerability exists in curl versions with IPFS support (7.81.0+). The IPFS_PATH environment variable is not properly sanitized, allowing attackers to read arbitrary files by manipulating directory traversal sequences (e.g., ../../../../etc). This flaw enables leakage of sensitive data (e.g., SSH keys, credentials, system files) via DNS/HTTP error messages. ## Type of AI used: Deepseek R1 (in some search and steps to reproduce and clear description of vuln ) ## Affected version: curl 8.13.0 (and all 7.81.0+ releases with IPFS support) ## curl --version: (x86_64-pc-linux-gnu) libcurl/8.13.0 GnuTLS/3.8.6 zlib/1.3.1 brotli/1.1.0 zstd/1.5.6 libidn2/2.3.7 libpsl/0.21.2 libssh2/1.11.1 nghttp2/1.62.1 ngtcp2/1.6.0 nghttp3/1.4.0 librtmp/2.3 OpenLDAP/2.6.9 Release-Date: 2025-04-02, security patched: 8.13.0-1 Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt pop3 pop3s rtmp rtsp scp sftp smb smbs smtp smtps telnet tftp ws wss Features: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTP3 HTTPS-proxy IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL threadsafe TLS-SRP UnixSockets zstd ## System: Kali GNU/Linux Rolling ## Applicable to: 1.CI/CD pipelines (leak build secrets). 2.Containers (escape to read host files). 3.Shared hosting environments. ## Steps To Reproduce (simple way): 1. make data-fetcher.sh 2. add this to data-fetcher.sh ``` #!/bin/bash # 1. Create test file with unique URL-like content TEST_CONTENT="http://LEAKED_DATA_$(date +%s).invalid" echo "$TEST_CONTENT" > /tmp/test_file.txt # 2. Setup exploit EXPLOIT_DIR=$(mktemp -d) ln -sf /tmp/test_file.txt "$EXPLOIT_DIR/gateway" export IPFS_PATH="$EXPLOIT_DIR" # 3. Trigger the vulnerability echo "[+] Testing exploit - should leak: $TEST_CONTENT" curl -v ipfs://dummycid 2>&1 | grep -A1 "Could not resolve host" # 4. Cleanup unset IPFS_PATH rm -rf "$EXPLOIT_DIR" /tmp/test_file.txt ``` 3. run ``` chmod +x data-fetcher.sh ./data-fetcher.sh ``` output: ``` [+] Testing exploit - should leak: http://LEAKED_DATA_1744992527.invalid 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Could not resolve host: LEAKED_DATA_1744992527.invalid shutting down connection #0 curl: (6) Could not resolve host: LEAKED_DATA_1744992527.invalid ``` ## Simple Example: Scenario: Document Viewer App …

Source code

No source code was retrieved for this analysis. The evidence may be incomplete.