curl: Authentication Credential Leakage via HTTP Redirects
CVE-2024-11053 Published on December 11, 2024

netrc and redirect credential leak
When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.

NVD

Vulnerability Analysis

CVE-2024-11053 can be exploited with network access, requires user interaction. This vulnerability is consided to have a high level of attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2024-11053. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
CHANGED
Confidentiality Impact:
LOW
Integrity Impact:
NONE
Availability Impact:
NONE

Products Associated with CVE-2024-11053

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-11053 are published in these products:

Haxx Curl
 
Oracle
 
NetApp Ontap Select Deploy Administration Utility
 
NetApp Ontap
 

Affected Versions

curl:

Exploit Probability

EPSS
0.95%
Percentile
76.08%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.