Docs Overview
Project
Bug Bounty Bug Report Code of conduct Dependencies Donate FAQ Features Governance History Install Known Bugs Logo TODO website Info
Protocols
CA Extract HTTP cookies HTTP/3 MQTT SSL certs SSL libs compared URL syntax WebSocket
Releases
Changelog curl CVEs Release Table Version Numbering Vulnerabilities
Tool
Comparison Table curl man page HTTP Scripting mk-ca-bundle Tutorial When options were added
Who and Why
Companies Copyright Sponsors Thanks The name
curl / Docs / curl CVEs / URL request injection
Related:
Audits
Bug Bounty
Changelog
curl CVEs
JSON metadata
Vulnerability Disclosure
Vulnerabilities Table

CVE-2014-8150

URL request injection

Project curl Security Advisory, January 8th 2015 - Permalink

VULNERABILITY

When libcurl sends a request to a server via an HTTP proxy, it copies the entire URL into the request and sends if off.

If the given URL contains line feeds and carriage returns those are sent along to the proxy too, which allows the program to for example send a separate HTTP request injected embedded in the URL.

Many programs allow some kind of external sources to set the URL or provide partial pieces for the URL to ask for, and if the URL as received from the user is not stripped good enough this flaw allows malicious users to do additional requests in a way that was not intended, or just to insert request headers into the request that the program did not intend.

INFO

This flaw can also affect the curl command line tool if a similar operation series is made with that.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2014-8150 to this issue.

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Severity: High

AFFECTED VERSIONS

libcurl is used by many applications, but not always advertised as such!

SOLUTION

libcurl 7.40.0 makes sure that the URL passed to the proxy may never contain neither carriage returns nor line feeds characters.

RECOMMENDATIONS

We suggest you take one of the following actions immediately, in order of preference:

A - Upgrade to curl and libcurl 7.40.0

B - Apply the patch and rebuild libcurl

C - Only use URLs that are carefully stripped from line feeds and carriage returns

TIMELINE

It was first reported to the curl project on December 25 2014.

We contacted distros@openwall on December 28.

libcurl 7.40.0 was released on January 8th 2015, coordinated with the publication of this advisory.

CREDITS

Thanks a lot!