{“lastseen”:”2025-10-01T07:25:44″,”description”:”## Summary\\n\\nWhen libcurl is built with AWS SigV4 support, enabling **verbose logging** (`CURLOPT_VERBOSE` or `–verbose`) causes the library to print both the **string-to-sign** and the **final HMAC signature** into logs.\\n\\nBecause signatures remain valid for several minutes and are derived directly from AWS credentials, this behavior leaks sensitive material into log files or consoles. Any operator, log aggregation system, or low-privileged account with read access to those logs can **replay authenticated AWS API calls** or recover details of signed requests.\\n\\nThis is a **credential leakage vulnerability** in libcurl\u2019s `http_aws_sigv4.c`.\\n\\n—\\n\\n## Affected Component\\n\\n* File: `lib\/http_aws_sigv4.c`\\n* Function: `aws_sigv4_add()`, which calls `infof()` with the string-to-sign and the computed signature.\\n* Affects: latest libcurl (tested on 8.x) with AWS SigV4 signing enabled.\\n\\n—\\n\\n## Steps to Reproduce\\n\\n- 1. Setup\\n\\n* Build libcurl with AWS SigV4 enabled (default since 7.75.0).\\n* Export valid AWS credentials (`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`).\\n* Enable verbose mode (`–verbose` or `CURLOPT_VERBOSE`).\\n\\n- 2. Run a Signed Request\\n\\nRun a simple signed AWS request, e.g. list S3 buckets:\\n\\n“`bash\\nAWS_ACCESS_KEY_ID=AWS_ACCESS_KEY… \\\\\\nAWS_SECRET_ACCESS_KEY=SECRET… \\\\\\ncurl –aws-sigv4 \\”aws:amz:us-east-1:s3\\” \\\\\\n –verbose \\\\\\n https:\/\/s3.amazonaws.com\/\\n“`\\n\\n- 3. Observe Logs\\n\\nIn the console (or redirected logs), libcurl prints sensitive information:\\n\\n“`\\n* string-to-sign: AWS4-HMAC-SHA256 20250929T124500Z …\\n* signature: 7a5d1c84e2c3d8f9…\\n“`\\n\\n – 4. Replay the Request\\n\\nAn attacker with access to these logs can immediately replay the request for several minutes:\\n\\n“`bash\\ncurl -H \\”Authorization: AWS4-HMAC-SHA256 Credential=…, SignedHeaders=…, Signature=7a5d1c84e2c3d8f9…\\” \\\\\\n https:\/\/s3.amazonaws.com\/\\n“`\\n\\nThe replay succeeds as long as the signature is within the validity window (typically 5 minutes).\\n\\n—\\n\\n## Impact\\n\\n* **Confidentiality:** AWS API credentials\/signatures are leaked into logs.\\n* **Integrity:** Attackers can **replay AWS API calls** (e.g., list buckets, upload\/download objects).\\n* **Availability:** Replay could be abused to flood services with valid signed requests.\\n* **Realistic scenario:** Any team using `–verbose` for troubleshooting, or logging libcurl output to central log collectors, unintentionally leaks AWS secrets to less-trusted operators.”,”published”:”2025-09-29T16:45:59″,”modified”:”2025-10-01T07:00:06″,”type”:”hackerone”,”title”:”curl: AWS SigV4 Signature Disclosure via Verbose Logging in libcurl”,”source”:””,”references”:””,”id”:”H1:3361913″,”bulletinFamily”:”bugbounty”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/hackerone.com\/reports\/3361913″,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-10-01T07:25:44″,”description”:”## Summary\\n\\nWhen libcurl is built with AWS SigV4 support, enabling **verbose logging** (`CURLOPT_VERBOSE` or `–verbose`) causes the library to print both the **string-to-sign** and the…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,117,13,33,7,11,5],"class_list":["post-19759","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-hackerone","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n