PT-2022-2694 · Curl+4 · Curl+4
Haxatron1
·
Published
2022-04-28
·
Updated
2026-05-18
·
CVE-2022-27780
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
cURL (affected versions not specified)
Description
The issue is related to the curl URL parser, which wrongly accepts percent-encoded URL separators like '/' when decoding the host name part of a URL. This can make it a different URL using the wrong host name when it is later retrieved. For example, a URL like
http://example.com%2F127.0.0.1/ would be allowed by the parser and get transposed into http://example.com/127.0.0.1/. This flaw can be used to circumvent filters, checks, and more.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
SSRF
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Linuxmint
Red Os
Ubuntu
Curl