{“lastseen”:”2025-10-12T08:38:54″,”description”:”## Summary:\\ncurl supports `-Q` or `–quote` (and libcurl `CURLOPT_QUOTE`) to specify \\”commands\\” to execute for ftp and SFTP connections. The SFTP supports commands that perform operations on filesystem objects. When the object path has a filename, the caller is supposed to quote the parameter (example: `-Q ‘chmod 777 \\”\/tmp\/example file\\”‘`). However, due to libcurl quote command parser ignoring extra parameters, omitting the quotes (or attempting to use shell quoting) will let the command execute and the operation will be attempted on unintended object.\\n\\nThe curl man page mentions that “`Filenames may be quoted shell-style to embed spaces or special characters.“`. This statement is misleading, as shells allow many more ways to quote spaces, for example as `\\\\ `, something that curl does not support. This may lead to app developer assume that shell quoting rules apply. If some software trusts the documentation and generates quote commands assuming the shell quoting applies, this may lead to situation where operations can be performed on untended objects.\\n\\nNo AI was used in research or generation of this report. Stop the AI slop!\\n\\n## Affected version\\ncurl 8.16.0\\n\\n## Steps To Reproduce:\\nHave curl built `–with-libssh2` (or `–with-libssh`, but I tested `–with-libssh2 `)\\n\\n 1. on target server: `echo 1 \\u003e \/tmp\/example; echo 2 \\u003e\/tmp\/\\”example file\\”`\\n 2. `echo \\u003e t; curl -Q ‘chmod 777 \/tmp\/example file’ -T t sftp:\/\/user@server\/tmp\/t`\\n\\nAs a result `\/tmp\/example` is modified to have permissions 777, not `\/tmp\/example file` as was intended.\\n\\nAnother example:\\n 1. on target server: `echo 1 \\u003e \/tmp\/example\\\\\\\\; echo 2 \\u003e\/tmp\/\\”example file\\”`\\n 2. `echo \\u003e t; curl -Q ‘chmod 777 \/tmp\/example\\\\ file’ -T t sftp:\/\/user@server\/tmp\/t`\\n\\nAs a result `\/tmp\/example\\\\` is modified to have permissions 777, not `\/tmp\/example file` as was intended.\\n\\n\\n## Remediation\\n- Adjust the quote parser in lib\/vssh\/libssh2.c `sftp_quote` and lib\/vssh\/libssh.c `myssh_in_SFTP_QUOTE` to error out if excess parameters are given to command (indicating the caller has mistakenly attempted to give path with space without correct quoting).\\n- Fix the documentation to not claim `shell-style quoting`.\\n\\n## Impact\\n\\n## Summary:\\n- Operations performed on wrong object, with associated security impacts (unintended information disclosure, data loss)”,”published”:”2025-10-10T17:40:46″,”modified”:”2025-10-12T08:38:16″,”type”:”hackerone”,”title”:”curl: Missing enforcement of SFTP quote syntax can lead to operation on wrong object”,”source”:””,”references”:””,”id”:”H1:3379102″,”bulletinFamily”:”bugbounty”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/hackerone.com\/reports\/3379102″,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-10-12T08:38:54″,”description”:”## Summary:\\ncurl supports `-Q` or `–quote` (and libcurl `CURLOPT_QUOTE`) to specify \\”commands\\” to execute for ftp and SFTP connections. The SFTP supports commands that perform…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,117,13,33,7,11,5],"class_list":["post-21207","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-hackerone","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n