← 返回地图破甲

curl RTSP connection reuse routes response headers to the RTP callback (rtsp_conn state machine not reset between sessions)

身份认证 / Unlabeled / #4121685

厂商
curl
严重程度
中危
赏金
—
弱点
Unlabeled
研究员
@noraqiu
披露日期
2026-10-19
资产
https://github.com/curl/curl
CVE
—

该报告还没有中文解读。

原文摘录

摘自原文(11753 字符中的一小部分)
libcurl's RTSP client keeps a per-connection RTP parsing state machine in `struct rtsp_conn` (`state`, `in_header`, `rtp_len`, `buf`). This state machine is initialised exactly once, when a brand-new connection is allocated, and is never reset thereafter. RTSP connections are pooled and reused …
原文中的代码
// lib/rtsp.c:105-122  rtsp_setup_connection()
//   rtspc = Curl_conn_meta_get(...); curlx_calloc(...) -> all fields zero
//   (state = RTP_PARSE_SKIP, in_header = FALSE, rtp_len = 0, buf empty)
//   Called ONLY when a new connection is created — not on reuse.

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 curl 所有。

时间线

阅读 HackerOne 原文 ↗作者 @noraqiu · 版权归作者与 curl 所有

同类报告

Takeover an account that doesn't have a Shopify ID and moreShopify · 2020-09-02Subdomain Takeover to Authentication bypassRoblox · 2020-04-23CVE-2019-5765: 1-click HackerOne account takeover on all Android devicesChrome · —GraphQL AdminGenerateSessionPayload is leaked to staff with no permissionShopify · 2020-07-16Session works after logout from Shopify account and password of online store is displayedShopify · 2020-04-27FULL ACCOUNT TAKEOVERMTN Group · 2024-08-17