Docs Overview
Project
Bug Bounty Bug Report Code of conduct Dependencies Donate FAQ Features Governance History Install Known Bugs Logo TODO website Info
Protocols
CA Extract HTTP cookies HTTP/3 MQTT SSL certs SSL libs compared URL syntax WebSocket
Releases
Changelog curl CVEs Release Table Version Numbering Vulnerabilities
Tool
Comparison Table curl man page HTTP Scripting mk-ca-bundle Tutorial When options were added
Who and Why
Companies Copyright Sponsors Thanks The name
curl / Docs / curl CVEs / curl overwrite local file with -J
Related:
Audits
Bug Bounty
Changelog
curl CVEs
JSON metadata
Original report
Vulnerability Disclosure
Vulnerabilities Table
Awarded 700 USD

CVE-2020-8177

curl overwrite local file with -J

Project curl Security Advisory, June 24th 2020 - Permalink

VULNERABILITY

curl can be tricked by a malicious server to overwrite a local file when using -J (--remote-header-name) and -i (--include) in the same command line.

The command line tool offers the -J option that saves a remote file using the filename present in the Content-Disposition: response header. curl then refuses to overwrite an existing local file using the same name, if one already exists in the current directory.

The -J flag is designed to save a response body, and so it does not work together with -i and there is logic that forbids it. However, the check is flawed and does not properly check for when the options are used in the reversed order: first using -J and then -i were mistakenly accepted.

The result of this mistake was that incoming HTTP headers could overwrite a local file if one existed, as the check to avoid the local file was done first when body data was received, and due to the mistake mentioned above, it could already have received and saved headers by that time.

The saved file would only get response headers added to it, as it would abort the saving when the first body byte arrives. A malicious server could however still be made to send back virtually anything as headers and curl would save them like this, until the first CRLF-CRLF sequence appears.

(Also note that -J needs to be used in combination with -O to have any effect.)

INFO

Users should be aware and never run curl with the -J option in their $HOME or other sensitive directories, independently of this flaw. Using curl that way allows curl to create any filename it likes (i.e. what the remote server suggests) and it can confuse or trick users if allowed to save files that can mistakenly be assumed to be "locally made" or part of the system rather than provided by a potentially malicious remote party.

This flaw can happen to users of the curl tool but not for applications using libcurl.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2020-8177 to this issue.

CWE-641: Improper Restriction of Names for Files and Other Resources

Severity: Medium

AFFECTED VERSIONS

SOLUTION

RECOMMENDATIONS

We suggest you take one of the following actions immediately, in order of preference:

A - Upgrade curl to version 7.71.0

B - Apply the patch on your curl version and rebuild

C - Do not use -J (in a directory with pre-existing files)

TIMELINE

This issue was first reported to the curl project on May 30, 2020.

This advisory was posted on June 24th 2020.

CREDITS

Thanks a lot!