Examples / Report #3272982 Saved analysis

Vulnerability Report: Public Exposure of Security Audit File

curl · 2025-07-2610.7s analysis · $0.009 in model calls

What the report claims

A sensitive internal security audit report for cURL/libcurl was found to be publicly accessible via search engine dorking.

Compare with curl's recorded outcome

Labeled AI slop

curl's maintainer lists this report as AI slop

Shown for comparison after analysis. The pipeline did not see this label.

ProveIt's finding

Needs human review

The available evidence does not settle the report. A maintainer should investigate.

Judgment withdrawn. The answer failed the evidence check.

See the withdrawn model reasoning

The following reasoning failed the citation check and does not support the final finding.

The report concerns a publicly accessible PDF audit report from 2016 on curl.se, not a flaw in curl's source code.
Security audit reports are often intentionally published for transparency; their public availability on the project's own domain is not a vulnerability in curl.
The described vulnerabilities are from 2016 (9 years ago) and are presumably patched in current versions.
No code path or curl behavior is identified that an attacker can exploit; the claim is about information disclosure of a historical document.

How this analysis ran 3 claims · 0 citations verified

Evidence check: judge said likely_invalid without a code citation contradicting a central claim

Checked against curl master on 2025-07-26 (73d52567a0e1). Test evaluation split. Citation verification checks that a referenced line was in the evidence; it does not prove the model interpreted it correctly.

1 · Grounding

nothing to check

no model · 0 references checked out, 0 did not

2 · Claims

NVIDIA-Nemotron-3-Nano-30B-A3B

3 claims · 1643 tokens · $0.0002

3 · Evidence

0 code snippets

real curl source at 73d52567a0e1 · 2 docs via Tavily

4 · Judgment

Nemotron-3-Ultra-550b-a55b

5892 tokens · 7.0s · $0.0091

5 · Receipts

0 of 0 citations verified

every citation must point at code the judge was shown

Inspect the withdrawn draft reply

This draft belongs to the withdrawn judgment. It may contain unsupported claims.

Thank you for reporting this. The file you reference (cure53-curl-report-2016.pdf) is a historical security audit report published on curl.se, likely intentionally for transparency. Its public availability is not a vulnerability in curl's code. The issues it describes are from 2016 and have been addressed in subsequent releases. We do not consider the publication of our own audit reports a security issue. If you believe a specific, unpatched vulnerability from that report still exists in current curl code, please file a separate report with a concrete code path and reproduction steps against a supported version.

Inspect all claims and source code 3 claims · 0 code excerpts

This model judgment was withdrawn. The claim assessments below are preserved for inspection and may be wrong.

Report claims

C1flaw not verifiable

The report details multiple vulnerabilities (e.g., Host Header Injection, TLS validation flaws, memory handling issues) with clear descriptions, impact, and affected code areas.

Read the reasoning

The claim describes the content of cure53-curl-report-2016.pdf, but the PDF itself is not provided in the evidence. The external sources (E1, E2) are unrelated Microsoft documentation and do not contain the audit report. Even if the claim were true, it describes a document about historical vulnerabilities, not a flaw in curl's code.

C2flaw not verifiable

The report includes technical steps, affected functions, and logic flaws that can be used to craft reliable exploits or proofs of concept (PoCs).

Read the reasoning

Same as C1: the claim is about the PDF's content, which is not provided. The external sources do not contain the audit report. This does not describe a vulnerability in curl's code.

C3flaw not verifiable

The report exposes how the code is audited, what weaknesses are common, and how securely certain parts are implemented—providing attackers with insight into the development process and threat modeling priorities.

Read the reasoning

Same as C1 and C2: the claim is about the PDF's content, which is not provided. This describes information disclosure of an audit report, not a code vulnerability in curl.

What the report says about other projects

not addressed The report details multiple vulnerabilities (e.g., Host Header Injection, TLS validation flaws, memory handling issues) with clear descriptions, impact, and affected code areas.

not addressed The report includes technical steps, affected functions, and logic flaws that can be used to craft reliable exploits or proofs of concept (PoCs).

not addressed The report exposes how the code is audited, what weaknesses are common, and how securely certain parts are implemented—providing attackers with insight into the development process and threat modeling priorities.

Read the original report (excerpt)

Full report on HackerOne ↗

##Summary: A sensitive internal security audit report file for cURL/libcurl—specifically cure53-curl-report-2016.pdf—was found to be publicly accessible via search engine dorking. This file includes detailed vulnerability findings, exploit vectors, code review observations, and remediation advice from the Cure53 audit engagement in 2016. The exposure of this report may aid malicious actors in reverse engineering older vulnerabilities or targeting systems running legacy versions of libcurl that have not been patched. The report was retrieved through Google dorking, indicating a potential oversight in public file indexing or access control. ##Steps To Reproduce: - Go to your browser and open Google (or any search engine). - Search using the following dorking query: site:curl.se grep - This reveals publicly accessible internal audit reports related to cURL. - Click the link titled cure53-curl-report-2016.pdf or go directly to: https://curl.se/docs/audit/cure53-curl-report-2016.pdf - Open the PDF and navigate to Page 10 to find the detailed description of the Host Header Injection vulnerability (ID: T6). ## Impact ## Summary: An attacker gaining access to the publicly exposed security audit file (cure53-curl-report-2016.pdf) can leverage the information within to: 1. Discover Exploitable Vulnerabilities: - The report details multiple vulnerabilities (e.g., Host Header Injection, TLS validation flaws, memory handling issues) with clear descriptions, impact, and affected code areas. - Even though some issues are patched, older systems or forks may still be vulnerable. 2. Develop Targeted Exploits: - The audit includes technical steps, affected functions, and logic flaws that can be used to craft reliable exploits or proofs of concept (PoCs). 3. Attack Legacy Systems: - Organizations or embedded systems using older versions of libcurl could still be exploitable if they haven’t applied patches. - Attackers could scan for such outdated deployments. 4. Undermine Software Supply Chain Security: - Projects or products depending on outdated libcurl could be targeted indirectly (supply chain attack surface increases). 5. Leak Internal Security Posture: - The report exposes how the code is audited, what weaknesses are common, and how securely certain parts are implemented—providing attackers with insight into the development process and threat model …

Source code

No source code was retrieved for this analysis. The evidence may be incomplete.