curl’s persistence files inherit world-readable/writable perms from umask, leaking and tampering with cookies/HSTS/Alt-Svc caches
该报告还没有中文解读。
原文摘录
摘自原文（2656 字符中的一小部分）
Executive Summary `Curl_fopen()` clones the permissions of any pre-existing persistence file when creating its temporary file. When the persistence file does not exist, it first creates one with the process umask (typically `022`, i.e., `0644`). That mode is then copied to the temp file via `0600` …
原文中的代码
rm -f /tmp/cookie-leak.txt && umask 022 \ && ./src/curl -s -o /dev/null -c /tmp/cookie-leak.txt https://example.org \ && ls -l /tmp/cookie-leak.txt .rw-r--r-- 131 geeknik 26 Oct 22:22 /tmp/cookie-leak.txt
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 curl 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @geeknik · 版权归作者与 curl 所有