{“lastseen”:”2025-12-20T16:48:27″,”description”:”================================================================================\\nDESCRIPTION:\\n================================================================================\\n\\n## Summary:\\n\\nI discovered a heap buffer over-read vulnerability in libcurl’s SMB protocol \\nimplementation. A malicious SMB server can send a specially crafted READ_ANDX \\nresponse that causes curl to read and output up to 28KB of uninitialized heap \\nmemory per request. This results in information disclosure to the attacker.\\n\\nThe vulnerability exists in lib\/smb.c within the smb_request_state() function,\\nspecifically in the SMB_DOWNLOAD state handler at lines 1110-1137.\\n\\nNo AI was used to discover this vulnerability. AI was used only to assist \\nwith report formatting.\\n\\n## Technical Analysis:\\n\\n**Vulnerable Code (lib\/smb.c lines 1116-1128):**\\n\\n“`c\\ncase SMB_DOWNLOAD:\\n if(h-\\u003estatus || smbc-\\u003egot \\u003c sizeof(struct smb_header) + 15) {\\n req-\\u003eresult = CURLE_RECV_ERROR;\\n next_state = SMB_CLOSE;\\n break;\\n }\\n \\n \/\/ [1] Values read directly from attacker-controlled server response\\n len = Curl_read16_le(((const unsigned char *)msg) +\\n sizeof(struct smb_header) + 11);\\n off = Curl_read16_le(((const unsigned char *)msg) +\\n sizeof(struct smb_header) + 13);\\n \\n if(len \\u003e 0) {\\n \/\/ [2] Bounds check validates against smbc-\\u003egot (total received bytes)\\n if(off + sizeof(unsigned int) + len \\u003e smbc-\\u003egot) {\\n failf(data, \\”Invalid input packet\\”);\\n result = CURLE_RECV_ERROR;\\n }\\n else\\n \/\/ [3] Out-of-bounds read occurs here – reads heap memory\\n result = Curl_client_write(data, CLIENTWRITE_BODY,\\n (char *)msg + off + sizeof(unsigned int),\\n len);\\n“`\\n\\n**Root Cause:**\\n\\n1. The attacker controls the NetBIOS header length field, allowing them to \\n claim a large message size (e.g., 0x7100 bytes)\\n \\n2. The attacker pads the response with null bytes to make smbc-\\u003egot match \\n the claimed size\\n\\n3. The attacker sets data_offset and data_length to read from any position \\n within the receive buffer\\n\\n4. The bounds check at [2] passes because off + 4 + len \\u003c= smbc-\\u003egot\\n\\n5. curl reads len bytes from msg + off + 4, which includes uninitialized \\n heap memory beyond the actual SMB response data\\n\\n**Result:** curl outputs ~28KB when the server only sent 256 bytes of \\nlegitimate data. The extra ~28KB is leaked heap memory.\\n\\n## Affected version:\\n\\n“`\\n$ curl -V\\ncurl 8.15.0 (x86_64-pc-linux-gnu) libcurl\/8.15.0 OpenSSL\/3.5.4 zlib\/1.3.1 \\nbrotli\/1.1.0 zstd\/1.5.7 libidn2\/2.3.8 libpsl\/0.21.2 libssh2\/1.11.1 \\nnghttp2\/1.64.0 nghttp3\/1.12.0 librtmp\/2.3 OpenLDAP\/2.6.10\\nRelease-Date: 2025-07-16\\nProtocols: dict file ftp ftps gopher gophers http https imap imaps ipfs \\nipns ldap ldaps mqtt pop3 pop3s rtmp rtsp scp sftp smb smbs smtp smtps \\ntelnet tftp ws wss\\nFeatures: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTP3 HTTPS-proxy \\nIDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL threadsafe TLS-SRP \\nUnixSockets zstd\\n\\nPlatform: Linux x86_64 (Kali GNU\/Linux Rolling)\\n“`\\n\\nAll curl versions with SMB support enabled (USE_CURL_NTLM_CORE defined) \\nare likely affected.\\n\\n## Steps To Reproduce:\\n\\n 1. Extract the attached PoC files to a directory\\n\\n 2. Run the automated exploit script:\\n “`\\n chmod +x run_exploit.sh\\n .\/run_exploit.sh\\n “`\\n\\n 3. Or manually:\\n \\n Terminal 1 – Start malicious server:\\n “`\\n python3 smb_exploit_server.py 4455\\n “`\\n \\n Terminal 2 – Connect with curl:\\n “`\\n curl -u anyuser:anypass -o leaked.bin smb:\/\/127.0.0.1:4455\/share\/file.txt\\n “`\\n \\n Terminal 2 – Verify the leak:\\n “`\\n ls -la leaked.bin\\n # Shows: 28672 bytes (server only sent 256)\\n \\n xxd leaked.bin | head -20\\n # First 256 bytes are ‘A’ (0x41), rest is heap memory\\n “`\\n\\n 4. Expected output:\\n “`\\n $ ls -la leaked.bin\\n -rw-rw-r– 1 user user 28672 Dec 18 13:00 leaked.bin\\n \\n $ xxd leaked.bin | head -20\\n 00000000: 4141 4141 4141 4141 4141 4141 4141 4141 AAAAAAAAAAAAAAAA\\n 00000010: 4141 4141 4141 4141 4141 4141 4141 4141 AAAAAAAAAAAAAAAA\\n … (256 bytes of ‘A’)\\n 00000100: 0000 0000 0000 0000 0000 0000 0000 0000 …………….\\n … (heap memory – 28416 bytes leaked)\\n “`\\n\\n## Supporting Material\/References:\\n\\n * smb_exploit_server.py – Malicious SMB server (Python 3)\\n * run_exploit.sh – Automated PoC runner script\\n * Vulnerable code: https:\/\/github.com\/curl\/curl\/blob\/master\/lib\/smb.c#L1110-L1137\\n * Buffer allocation: https:\/\/github.com\/curl\/curl\/blob\/master\/lib\/smb.c#L505\\n\\n## Impact\\n\\n================================================================================\\nIMPACT:\\n================================================================================\\n\\n**Severity: Medium (CVSS 6.5)**\\n\\n**CWE-125: Out-of-bounds Read**\\n\\nA remote attacker operating a malicious SMB server can exploit this \\nvulnerability to achieve:\\n\\n**1. Heap Memory Disclosure**\\n\\nThe attacker can exfiltrate up to 28KB of heap memory from the curl client \\nprocess per SMB READ request. This memory may contain:\\n\\n- Authentication credentials from previous HTTP\/FTP requests\\n- Session tokens and API keys\\n- Private data from other network operations\\n- Memory layout information useful for further exploitation\\n\\n**2. Attack Vectors**\\n\\n- Phishing: Send victim a link to smb:\/\/attacker-server\/share\/file.txt\\n- Typosquatting: Register domains similar to legitimate SMB servers\\n- Man-in-the-Middle: Intercept SMB connections and inject malicious responses\\n- Compromised Infrastructure: Attacker compromises an internal SMB server\\n\\n**3. Exploitation Requirements**\\n\\n- Victim must connect to attacker-controlled SMB server\\n- curl must be compiled with SMB support (common in Linux distributions)\\n- No authentication required – server accepts any credentials\\n- No user interaction beyond clicking a link\\n- Attack is silent – victim receives no error messages\\n\\n**4. Proof of Exploitation**\\n\\nThe attached PoC demonstrates:\\n- Server sends 256 bytes of legitimate data\\n- curl receives and outputs 28,672 bytes\\n- 28,416 bytes of heap memory are leaked\\n\\n**Recommended Fix:**\\n\\nValidate that data_offset points within the actual SMB READ_ANDX response \\nstructure, not just within the total received bytes. The offset should be \\nchecked against the expected message layout and byte_count field.”,”published”:”2025-12-18T11:38:43″,”modified”:”2025-12-20T15:57:55″,”type”:”hackerone”,”title”:”curl: Heap Buffer Over-Read via Malicious SMB Server READ_ANDX Response”,”source”:””,”references”:””,”id”:”H1:3470095″,”bulletinFamily”:”bugbounty”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/hackerone.com\/reports\/3470095″,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-20T16:48:27″,”description”:”================================================================================\\nDESCRIPTION:\\n================================================================================\\n\\n## Summary:\\n\\nI discovered a heap buffer over-read vulnerability in libcurl’s SMB protocol \\nimplementation. A malicious SMB server can send a specially crafted READ_ANDX \\nresponse that…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,117,13,33,7,11,5],"class_list":["post-32361","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-hackerone","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n