Resolves: CVE-2022-27776 - fix auth/cookie leak on redirect
This commit is contained in:
Kamil Dudka
parent
159cab915b
commit
ee9c88927d
246
0004-curl-7.82.0-CVE-2022-27776.patch
Normal file
246
0004-curl-7.82.0-CVE-2022-27776.patch
Normal file
@ -0,0 +1,246 @@
|
|||||||
|
From 2be87227d4b4024c91ff6c856520cac9c9619555 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Daniel Stenberg <daniel@haxx.se>
|
||||||
|
Date: Mon, 25 Apr 2022 13:05:40 +0200
|
||||||
|
Subject: [PATCH 1/2] http: avoid auth/cookie on redirects same host diff port
|
||||||
|
|
||||||
|
CVE-2022-27776
|
||||||
|
|
||||||
|
Reported-by: Harry Sintonen
|
||||||
|
Bug: https://curl.se/docs/CVE-2022-27776.html
|
||||||
|
Closes #8749
|
||||||
|
|
||||||
|
Upstream-commit: 6e659993952aa5f90f48864be84a1bbb047fc258
|
||||||
|
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
||||||
|
---
|
||||||
|
lib/http.c | 34 ++++++++++++++++++++++------------
|
||||||
|
lib/urldata.h | 16 +++++++++-------
|
||||||
|
2 files changed, 31 insertions(+), 19 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/lib/http.c b/lib/http.c
|
||||||
|
index 799d4fb..0791dcf 100644
|
||||||
|
--- a/lib/http.c
|
||||||
|
+++ b/lib/http.c
|
||||||
|
@@ -775,6 +775,21 @@ output_auth_headers(struct Curl_easy *data,
|
||||||
|
return CURLE_OK;
|
||||||
|
}
|
||||||
|
|
||||||
|
+/*
|
||||||
|
+ * allow_auth_to_host() tells if autentication, cookies or other "sensitive
|
||||||
|
+ * data" can (still) be sent to this host.
|
||||||
|
+ */
|
||||||
|
+static bool allow_auth_to_host(struct Curl_easy *data)
|
||||||
|
+{
|
||||||
|
+ struct connectdata *conn = data->conn;
|
||||||
|
+ return (!data->state.this_is_a_follow ||
|
||||||
|
+ data->set.allow_auth_to_other_hosts ||
|
||||||
|
+ (data->state.first_host &&
|
||||||
|
+ strcasecompare(data->state.first_host, conn->host.name) &&
|
||||||
|
+ (data->state.first_remote_port == conn->remote_port) &&
|
||||||
|
+ (data->state.first_remote_protocol == conn->handler->protocol)));
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
/**
|
||||||
|
* Curl_http_output_auth() setups the authentication headers for the
|
||||||
|
* host/proxy and the correct authentication
|
||||||
|
@@ -847,17 +862,14 @@ Curl_http_output_auth(struct Curl_easy *data,
|
||||||
|
with it */
|
||||||
|
authproxy->done = TRUE;
|
||||||
|
|
||||||
|
- /* To prevent the user+password to get sent to other than the original
|
||||||
|
- host due to a location-follow, we do some weirdo checks here */
|
||||||
|
- if(!data->state.this_is_a_follow ||
|
||||||
|
+ /* To prevent the user+password to get sent to other than the original host
|
||||||
|
+ due to a location-follow */
|
||||||
|
+ if(allow_auth_to_host(data)
|
||||||
|
#ifndef CURL_DISABLE_NETRC
|
||||||
|
- conn->bits.netrc ||
|
||||||
|
+ || conn->bits.netrc
|
||||||
|
#endif
|
||||||
|
- !data->state.first_host ||
|
||||||
|
- data->set.allow_auth_to_other_hosts ||
|
||||||
|
- strcasecompare(data->state.first_host, conn->host.name)) {
|
||||||
|
+ )
|
||||||
|
result = output_auth_headers(data, conn, authhost, request, path, FALSE);
|
||||||
|
- }
|
||||||
|
else
|
||||||
|
authhost->done = TRUE;
|
||||||
|
|
||||||
|
@@ -1905,10 +1917,7 @@ CURLcode Curl_add_custom_headers(struct Curl_easy *data,
|
||||||
|
checkprefix("Cookie:", compare)) &&
|
||||||
|
/* be careful of sending this potentially sensitive header to
|
||||||
|
other hosts */
|
||||||
|
- (data->state.this_is_a_follow &&
|
||||||
|
- data->state.first_host &&
|
||||||
|
- !data->set.allow_auth_to_other_hosts &&
|
||||||
|
- !strcasecompare(data->state.first_host, conn->host.name)))
|
||||||
|
+ !allow_auth_to_host(data))
|
||||||
|
;
|
||||||
|
else {
|
||||||
|
#ifdef USE_HYPER
|
||||||
|
@@ -2084,6 +2093,7 @@ CURLcode Curl_http_host(struct Curl_easy *data, struct connectdata *conn)
|
||||||
|
return CURLE_OUT_OF_MEMORY;
|
||||||
|
|
||||||
|
data->state.first_remote_port = conn->remote_port;
|
||||||
|
+ data->state.first_remote_protocol = conn->handler->protocol;
|
||||||
|
}
|
||||||
|
Curl_safefree(data->state.aptr.host);
|
||||||
|
|
||||||
|
diff --git a/lib/urldata.h b/lib/urldata.h
|
||||||
|
index 03da59a..f92052a 100644
|
||||||
|
--- a/lib/urldata.h
|
||||||
|
+++ b/lib/urldata.h
|
||||||
|
@@ -1329,14 +1329,16 @@ struct UrlState {
|
||||||
|
char *ulbuf; /* allocated upload buffer or NULL */
|
||||||
|
curl_off_t current_speed; /* the ProgressShow() function sets this,
|
||||||
|
bytes / second */
|
||||||
|
- char *first_host; /* host name of the first (not followed) request.
|
||||||
|
- if set, this should be the host name that we will
|
||||||
|
- sent authorization to, no else. Used to make Location:
|
||||||
|
- following not keep sending user+password... This is
|
||||||
|
- strdup() data.
|
||||||
|
- */
|
||||||
|
+
|
||||||
|
+ /* host name, port number and protocol of the first (not followed) request.
|
||||||
|
+ if set, this should be the host name that we will sent authorization to,
|
||||||
|
+ no else. Used to make Location: following not keep sending user+password.
|
||||||
|
+ This is strdup()ed data. */
|
||||||
|
+ char *first_host;
|
||||||
|
+ int first_remote_port;
|
||||||
|
+ unsigned int first_remote_protocol;
|
||||||
|
+
|
||||||
|
int retrycount; /* number of retries on a new connection */
|
||||||
|
- int first_remote_port; /* remote port of the first (not followed) request */
|
||||||
|
struct Curl_ssl_session *session; /* array of 'max_ssl_sessions' size */
|
||||||
|
long sessionage; /* number of the most recent session */
|
||||||
|
struct tempbuf tempwrite[3]; /* BOTH, HEADER, BODY */
|
||||||
|
--
|
||||||
|
2.34.1
|
||||||
|
|
||||||
|
|
||||||
|
From c0d12f1634785596746e5d461319dcb95b5b6ae8 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Daniel Stenberg <daniel@haxx.se>
|
||||||
|
Date: Mon, 25 Apr 2022 13:05:47 +0200
|
||||||
|
Subject: [PATCH 2/2] test898: verify the fix for CVE-2022-27776
|
||||||
|
|
||||||
|
Do not pass on Authorization headers on redirects to another port
|
||||||
|
|
||||||
|
Upstream-commit: afe752e0504ab60bf63787ede0b992cbe1065f78
|
||||||
|
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
||||||
|
---
|
||||||
|
tests/data/Makefile.inc | 2 +-
|
||||||
|
tests/data/test898 | 90 +++++++++++++++++++++++++++++++++++++++++
|
||||||
|
2 files changed, 91 insertions(+), 1 deletion(-)
|
||||||
|
create mode 100644 tests/data/test898
|
||||||
|
|
||||||
|
diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
|
||||||
|
index 59d46bc..7ae2cf8 100644
|
||||||
|
--- a/tests/data/Makefile.inc
|
||||||
|
+++ b/tests/data/Makefile.inc
|
||||||
|
@@ -109,7 +109,7 @@ test854 test855 test856 test857 test858 test859 test860 test861 test862 \
|
||||||
|
test863 test864 test865 test866 test867 test868 test869 test870 test871 \
|
||||||
|
test872 test873 test874 test875 test876 test877 test878 test879 test880 \
|
||||||
|
test881 test882 test883 test884 test885 test886 test887 test888 test889 \
|
||||||
|
-test890 test891 test892 test893 test894 test895 test896 test897 \
|
||||||
|
+test890 test891 test892 test893 test894 test895 test896 test897 test898 \
|
||||||
|
\
|
||||||
|
test900 test901 test902 test903 test904 test905 test906 test907 test908 \
|
||||||
|
test909 test910 test911 test912 test913 test914 test915 test916 test917 \
|
||||||
|
diff --git a/tests/data/test898 b/tests/data/test898
|
||||||
|
new file mode 100644
|
||||||
|
index 0000000..5cbb7d8
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/tests/data/test898
|
||||||
|
@@ -0,0 +1,90 @@
|
||||||
|
+<testcase>
|
||||||
|
+<info>
|
||||||
|
+<keywords>
|
||||||
|
+HTTP
|
||||||
|
+--location
|
||||||
|
+Authorization
|
||||||
|
+Cookie
|
||||||
|
+</keywords>
|
||||||
|
+</info>
|
||||||
|
+
|
||||||
|
+#
|
||||||
|
+# Server-side
|
||||||
|
+<reply>
|
||||||
|
+<data>
|
||||||
|
+HTTP/1.1 301 redirect
|
||||||
|
+Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||||
|
+Server: test-server/fake
|
||||||
|
+Content-Length: 0
|
||||||
|
+Connection: close
|
||||||
|
+Content-Type: text/html
|
||||||
|
+Location: http://firsthost.com:9999/a/path/%TESTNUMBER0002
|
||||||
|
+
|
||||||
|
+</data>
|
||||||
|
+<data2>
|
||||||
|
+HTTP/1.1 200 OK
|
||||||
|
+Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||||
|
+Server: test-server/fake
|
||||||
|
+Content-Length: 4
|
||||||
|
+Connection: close
|
||||||
|
+Content-Type: text/html
|
||||||
|
+
|
||||||
|
+hey
|
||||||
|
+</data2>
|
||||||
|
+
|
||||||
|
+<datacheck>
|
||||||
|
+HTTP/1.1 301 redirect
|
||||||
|
+Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||||
|
+Server: test-server/fake
|
||||||
|
+Content-Length: 0
|
||||||
|
+Connection: close
|
||||||
|
+Content-Type: text/html
|
||||||
|
+Location: http://firsthost.com:9999/a/path/%TESTNUMBER0002
|
||||||
|
+
|
||||||
|
+HTTP/1.1 200 OK
|
||||||
|
+Date: Tue, 09 Nov 2010 14:49:00 GMT
|
||||||
|
+Server: test-server/fake
|
||||||
|
+Content-Length: 4
|
||||||
|
+Connection: close
|
||||||
|
+Content-Type: text/html
|
||||||
|
+
|
||||||
|
+hey
|
||||||
|
+</datacheck>
|
||||||
|
+
|
||||||
|
+</reply>
|
||||||
|
+
|
||||||
|
+#
|
||||||
|
+# Client-side
|
||||||
|
+<client>
|
||||||
|
+<server>
|
||||||
|
+http
|
||||||
|
+</server>
|
||||||
|
+ <name>
|
||||||
|
+HTTP with custom auth and cookies redirected to HTTP on a diff port
|
||||||
|
+ </name>
|
||||||
|
+ <command>
|
||||||
|
+-x http://%HOSTIP:%HTTPPORT http://firsthost.com -L -H "Authorization: Basic am9lOnNlY3JldA==" -H "Cookie: userpwd=am9lOnNlY3JldA=="
|
||||||
|
+</command>
|
||||||
|
+</client>
|
||||||
|
+
|
||||||
|
+#
|
||||||
|
+# Verify data after the test has been "shot"
|
||||||
|
+<verify>
|
||||||
|
+<protocol>
|
||||||
|
+GET http://firsthost.com/ HTTP/1.1
|
||||||
|
+Host: firsthost.com
|
||||||
|
+User-Agent: curl/%VERSION
|
||||||
|
+Accept: */*
|
||||||
|
+Proxy-Connection: Keep-Alive
|
||||||
|
+Authorization: Basic am9lOnNlY3JldA==
|
||||||
|
+Cookie: userpwd=am9lOnNlY3JldA==
|
||||||
|
+
|
||||||
|
+GET http://firsthost.com:9999/a/path/%TESTNUMBER0002 HTTP/1.1
|
||||||
|
+Host: firsthost.com:9999
|
||||||
|
+User-Agent: curl/%VERSION
|
||||||
|
+Accept: */*
|
||||||
|
+Proxy-Connection: Keep-Alive
|
||||||
|
+
|
||||||
|
+</protocol>
|
||||||
|
+</verify>
|
||||||
|
+</testcase>
|
||||||
|
--
|
||||||
|
2.34.1
|
||||||
|
|
||||||
@ -19,6 +19,9 @@ Patch2: 0002-curl-7.82.0-CVE-2022-22576.patch
|
|||||||
# fix bad local IPv6 connection reuse (CVE-2022-27775)
|
# fix bad local IPv6 connection reuse (CVE-2022-27775)
|
||||||
Patch3: 0003-curl-7.82.0-CVE-2022-27775.patch
|
Patch3: 0003-curl-7.82.0-CVE-2022-27775.patch
|
||||||
|
|
||||||
|
# fix auth/cookie leak on redirect (CVE-2022-27776)
|
||||||
|
Patch4: 0004-curl-7.82.0-CVE-2022-27776.patch
|
||||||
|
|
||||||
# patch making libcurl multilib ready
|
# patch making libcurl multilib ready
|
||||||
Patch101: 0101-curl-7.32.0-multilib.patch
|
Patch101: 0101-curl-7.32.0-multilib.patch
|
||||||
|
|
||||||
@ -196,6 +199,7 @@ be installed.
|
|||||||
%patch1 -p1
|
%patch1 -p1
|
||||||
%patch2 -p1
|
%patch2 -p1
|
||||||
%patch3 -p1
|
%patch3 -p1
|
||||||
|
%patch4 -p1
|
||||||
|
|
||||||
# Fedora patches
|
# Fedora patches
|
||||||
%patch101 -p1
|
%patch101 -p1
|
||||||
@ -424,6 +428,7 @@ rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la
|
|||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
* Thu Apr 28 2022 Kamil Dudka <kdudka@redhat.com> - 7.82.0-3
|
* Thu Apr 28 2022 Kamil Dudka <kdudka@redhat.com> - 7.82.0-3
|
||||||
|
- fix auth/cookie leak on redirect (CVE-2022-27776)
|
||||||
- fix bad local IPv6 connection reuse (CVE-2022-27775)
|
- fix bad local IPv6 connection reuse (CVE-2022-27775)
|
||||||
- fix OAUTH2 bearer bypass in connection re-use (CVE-2022-22576)
|
- fix OAUTH2 bearer bypass in connection re-use (CVE-2022-22576)
|
||||||
|
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user