Description
Description:
The $openssl code in curl 8.17.0.1 allows exploitation.
Steps to reproduce:
1) Extract and install curl on Windows.
2) See the code in mk-ca-bundle.
Affected:
curl:8.17.0.1
SO:Windows 11/10/8
Helped analized:
Deep Seek
perl
$result = `"$openssl" dgst -r -sha256 "$_[0]"`;
Problem: The $_[0] parameter is directly interpolated into the shell command.
Risk: Attack can execute arbitrary commands.
Example of exploitation:
perl
sha256("file.txt; rm -rf /")
sha256("file.txt; cat /etc/passwd")
Best,
@tomar-re
## Impact
Extraction of confidential information.
The $openssl code in curl 8.17.0.1 allows exploitation.
Steps to reproduce:
1) Extract and install curl on Windows.
2) See the code in mk-ca-bundle.
Affected:
curl:8.17.0.1
SO:Windows 11/10/8
Helped analized:
Deep Seek
perl
$result = `"$openssl" dgst -r -sha256 "$_[0]"`;
Problem: The $_[0] parameter is directly interpolated into the shell command.
Risk: Attack can execute arbitrary commands.
Example of exploitation:
perl
sha256("file.txt; rm -rf /")
sha256("file.txt; cat /etc/passwd")
Best,
@tomar-re
## Impact
Extraction of confidential information.
Basic Information
ID
H1:3418760
Published
Nov 10, 2025 at 17:36
Modified
Nov 11, 2025 at 06:41