medium6.8Public exploit code

CVE-2009-0037

The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location values, which might all…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

cURL/libcURL 7.19.3 - HTTP 'Location:' Redirect Security Bypass2009-03-03 · remote · linux · Verified

Impact

The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3) execute arbitrary commands via a redirect to an scp: URL.

Affected products

Vendor	Product	Affected versions
Curl	Curl	Versions 5.11, 6.0, 6.1beta, 6.2, 6.3, 6.3.1
Curl	Libcurl	Versions 5.11, 7.12, 7.12.1, 7.12.2, 7.12.3, 7.13

Weakness classification

CWE-352

Public exploit code

Impact

Affected products

Weakness classification

References