Generation of Predictable Numbers or Identifiers Affecting curl package, versions [,8.16.0)

curl is a command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, MQTT, POP3, POP3S, RTMP, RTMPS, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET and TFTP. libcurl offers a myriad of powerful features.

Affected versions of this package are vulnerable to Generation of Predictable Numbers or Identifiers via the websocket component due to using a fixed 32 bit mask that persisted and was used throughout the entire connection instead of updating it for each new outgoing frame as the specification says. An attacker can manipulate traffic between communicating parties by exploiting the use of the fixed mask, potentially causing a proxy to cache maliciously crafted HTTP content that could later be served to other users.

Notes:

1. This is only exploitable if the libcurl-using application is communicating through such a (defective) proxy that confuses a WebSocket communication for HTTP traffic. Further, to trigger the problem it requires the traffic to be done using clear text HTTP / WebSocket (ws://) and not over TLS (wss://);

2. This flaw also affects the curl command line tool.

• GitHub Commit
• HackerOne Report
• Vulnerability Report