✓ProveIt
Examples / Report #874778 Saved analysis

CVE-2020-8169: Partial password leak over DNS on HTTP redirect

curl · 2020-05-1518.0s analysis · $0.011 in model calls

What the report claims

Partial password leak over DNS on HTTP redirect

Compare with curl's recorded outcome

Known vulnerability

A real vulnerability: CVE-2020-8169 Partial password leak over DNS on HTTP redirect

Shown for comparison after analysis. The pipeline did not see this label.

ProveIt's finding

Needs human review

The available evidence does not settle the report. A maintainer should investigate.

Why this finding?
  • The provided curl source code snippet (include/curl/curl.h:695-715) does not contain the HTTP redirect handling logic, credential management, or DNS resolution code that would confirm or contradict the claims.
  • The deterministic checks report 'grounded' but the deciding code is not included in the provided source excerpt.
  • The report describes a plausible and well-documented issue (CVE-2020-8169) with concrete reproduction steps, but verification requires examining the redirect handling code (likely in lib/http.c or similar) which is not provided.
What still needs checking
  • Source code for HTTP redirect handling (301/302 processing with relative Location headers)
  • Code that constructs the new URL for redirected requests including credential embedding
  • DNS resolution code path that sends the hostname to the resolver
How this analysis ran 5 claims · 0 citations verified

Checked against curl master on 2020-05-15 (8df455479f88). Dev evaluation split. Citation verification checks that a referenced line was in the evidence; it does not prove the model interpreted it correctly.

1 · Grounding
grounded
no model · 1 references checked out, 0 did not
2 · Claims
NVIDIA-Nemotron-3-Nano-30B-A3B
5 claims · 8117 tokens · $0.0011
3 · Evidence
1 code snippets
real curl source at 8df455479f88 · 1 docs via Tavily
4 · Judgment
Nemotron-3-Ultra-550b-a55b
5957 tokens · 7.1s · $0.0103
5 · Receipts
0 of 0 citations verified
every citation must point at code the judge was shown
Review a draft reply to the reporter

Edit and verify before sending.

Thank you for the detailed report with reproduction steps. The provided code excerpt does not include the HTTP redirect handling logic needed to verify the claims. Could you point to the specific source files/functions (e.g., in lib/http.c) where relative redirects are processed and the new URL with credentials is constructed? This will allow us to confirm the fix.

Inspect all claims and source code 5 claims · 1 code excerpts

Report claims

C1flaw not verifiable

curl leaks part of user credentials in the plain text DNS request when a server redirects with a relative path (e.g., Location: /login)

Read the reasoning

The provided source code (include/curl/curl.h lines 695-715) only shows proxy type enums and does not contain the HTTP redirect handling logic (CURLX301/CURLX302) or credential structures. The code that constructs the redirected URL and triggers DNS resolution is not in the provided excerpt.

C2location not verifiable

Location header with relative path triggers the leak

Read the reasoning

The redirect processing code that parses the Location header and handles relative vs absolute paths is not present in the provided source snippet.

C3trigger not verifiable

Server sends a 301 or 302 response with a relative URL in the Location header

Read the reasoning

The server response handling for 301/302 status codes with relative Location headers is not shown in the provided code.

C4impact not verifiable

User credentials (including password) are sent in plain text to the DNS server, allowing remote capture

Read the reasoning

The DNS resolution code path that would send the constructed hostname (including embedded credentials) to the DNS server is not in the provided source.

C5reproduction not verifiable

Run curl with -u username:password against a URL that returns a relative redirect, then observe DNS query containing the password

Read the reasoning

The reproduction steps reference curl versions 7.62-7.70 but the provided source code excerpt does not include the relevant redirect/credential handling functions to verify the code path.

What the report says about other projects

not addressed The DNS request includes the full user:password string as part of the hostname query

Read the original report (excerpt)

Full report on HackerOne ↗

## Summary: From version 7.62 curl and curllib leaks part of user credentials in the plain text DNS request. This happens if the server makes redirect, both 301 and 302 to a relative path (eg header 'Location: /login'). It is NOT an issue in case of absolute redirection (eg header 'Location: https://domain.tld/login'). I was able to make curl/curlib to send a password that started with @ but I believe that more abuse is possible with this attack. What makes is worst is that for eg occasionally run/daemon scripts with curl and authorization credentials this can be triggered by a remote server by switching between absolute/relative without any change on client-side. User secrets are sent in plain text and anybody in the middle can record them. User secrets are sent to the DNS server and can be recorded there. ## Steps To Reproduce: 1. Use curl > 7.61 (tested on all from 7.62 to 7.70 and I was able to exploit it) 1. Find a server with relative redirection (eg https://mareksz.gq/301 or https://mareksz.gq/302) 1. Run 'curl https://mareksz.gq/302 -v -L -u saduser:@S3cr3t' ## Supporting Material/References: Logs from running above steps: / $ curl -V curl 7.66.0-DEV (x86_64-pc-linux-gnu) libcurl/7.66.0-DEV OpenSSL/1.1.1d zlib/1.2.11 nghttp2/1.39.2 Release-Date: [unreleased] Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s rtsp smb smbs smtp smtps telnet tftp Features: AsynchDNS HTTP2 HTTPS-proxy IPv6 Largefile libz NTLM NTLM_WB SSL TLS-SRP UnixSockets / $ curl https://mareksz.gq/302 -v -L -u saduser:@S3cr3t * Trying 194.182.85.202:443... * TCP_NODELAY set * Connected to mareksz.gq (194.182.85.202) port 443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: /etc/ssl/certs/ca-certificates.crt CApath: none * TLSv1.3 (OUT), TLS handshake, Client hello (1): * TLSv1.3 (IN), TLS handshake, Server hello (2): * TLSv1.2 (IN), TLS handshake, Certificate (11): * TLSv1.2 (IN), TLS handshake, Server key exchange (12): * TLSv1.2 (IN), TLS handshake, Server finished (14): * TLSv1.2 (OUT), TLS handshake, Client key exchange (16): * TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1): * TLSv1.2 (OUT), TLS handshake, Finished (20): * TLSv1.2 (IN), TLS handshake, Finished (20): * SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384 * ALPN, server accepted to use http/1.1 * Server …

Source code

include/curl/curl.hlines 695–715 · definition of CURLcode
695typedef CURLcode (*curl_ssl_ctx_callback)(CURL *curl, /* easy handle */
696 void *ssl_ctx, /* actually an OpenSSL
697 or WolfSSL SSL_CTX,
698 or an mbedTLS
699 mbedtls_ssl_config */
700 void *userptr);
701
702typedef enum {
703 CURLPROXY_HTTP = 0, /* added in 7.10, new in 7.19.4 default is to use
704 CONNECT HTTP/1.1 */
705 CURLPROXY_HTTP_1_0 = 1, /* added in 7.19.4, force to use CONNECT
706 HTTP/1.0 */
707 CURLPROXY_HTTPS = 2, /* added in 7.52.0 */
708 CURLPROXY_SOCKS4 = 4, /* support added in 7.15.2, enum existed already
709 in 7.10 */
710 CURLPROXY_SOCKS5 = 5, /* added in 7.10 */
711 CURLPROXY_SOCKS4A = 6, /* added in 7.18.0 */
712 CURLPROXY_SOCKS5_HOSTNAME = 7 /* Use the SOCKS5 protocol but pass along the
713 host name rather than the IP address. added
714 in 7.18.0 */
715} curl_proxytype; /* this enum was added in 7.10 */