3 ms·
`curl` is widely integrated via its CLI: you'll find all kinds of programs (from simple shell scripts to actual compiled binaries) that interact with `curl` thr
by woodruffw 4y ago
`curl` is widely integrated via its CLI: you'll find all kinds of programs (from simple shell scripts to actual compiled binaries) that interact with `curl` through command-line arguments. So the attacker model here isn't "nobody would type this" it's "does your SoHo router or other software shell out to cURL in an attacker-controllable way."
- verall 4y agoIf an attacker could control the curl CLI on your SoHo router, couldn't they just direct it to download their evil payload, and then use one of a million more common problems to run the evil? Or directly exfiltrate data through HTTP requests made by curl? I don't think anyone runs curl as root so there is no privilege escalation. Seriously I can't understand the threat model here.
- woodruffw 4y agoThere are different scopes: it's not the case that every controllable CLI invocation is also one where an attacker could change the URL entirely. There are cases where they might only be able to change the behavior of a single flag or option, or a subrange of characters in a specific protocol's URLs, etc. I think the realistic attack model here is: 1. SoHo router that has a public accessible endpoint that takes inputs boiling down to "safe" cURL flags; 2. Those flags can actually induce memory corruption; 3. An attacker is able to execute arbitrary remote code in the context of the cURL subprocess through a payload packed into the "safe" flag.
- deleted 4y ago[deleted]