"Exposure of Hard-coded Private Keys and Credentials in #curl Source Repository"
a "critical" issue.
We have this test suite in git...
⇧
"Exposure of Hard-coded Private Keys and Credentials in #curl Source Repository"
a "critical" issue.
We have this test suite in git...
daniel:// stenberg://
in reply to daniel:// stenberg:// • • •"This report, including the verification steps and analysis, was prepared using an AI security assistant to ensure comprehensive and reproducible results."
Thanks. Great.
daniel:// stenberg://
in reply to daniel:// stenberg:// • • •curl disclosed on HackerOne: Exposure of Hard-coded Private Keys...
HackerOnepmelon
in reply to daniel:// stenberg:// • • •Huw R
in reply to daniel:// stenberg:// • • •classic! I got pulled into a Big Serious Meeting with the boss 15 years ago about this sort of thing once!
Thing is: it was literally foo/bar and had a name like “testCreds” 🤪
I’ll never forget the Senior Developer who was there to throw me under the bus, too!
(I quit shortly after)
greem
in reply to daniel:// stenberg:// • • •Rusty
in reply to daniel:// stenberg:// • • •Is it weird that I read these like they're comics?
The Adventures of Bagder in Hackerland:
Hilarious antics ensue when another AI-assisted researcher discovers another serious security flaw in the curl project...
Will the future of the known internet be forever changed?
Will the report stay open for longer than 3 hours?
Will the AI finally get a bug bounty?
Probably nah, but let's watch anyway.
Andrey Bondarenko
in reply to daniel:// stenberg:// • • •often frowned upon
in reply to daniel:// stenberg:// • • •lmao.
"I just found this in the trashcan nearby. Didn't know it was garbage. Did you expect me to smell it or something?"
Mikołaj Hołysz
in reply to daniel:// stenberg:// • • •excds
in reply to Mikołaj Hołysz • • •Cley Faye
in reply to daniel:// stenberg:// • • •oh, we got one like these too (as a private business with no bounty or anything even). Extremely critical disclosure of credentials, abuse risk, lenghty "report" with long steps and stuff, with reproduction against a third party service.
We had the default maptiler key from element-web's default config.json served somewhere (it is in their github repository), alongside with… the URL of our server, served by that very same URL. Which is public.
A great loss of time indeed.
excds
in reply to daniel:// stenberg:// • • •This just makes me want to scream.
But do they actually believe that they are submitting something useful?
Also: The act of asking another human "Hey, does this thing make sense?" seems to have been completely forgotten.
Billy O'Neal
in reply to daniel:// stenberg:// • • •secret scanning is a good idea given the number of checked in keys in the world.
But we still have to explain every couple years to folks that the "compiler can process .pfx files" unit tests aren't security problems 😅
daniel:// stenberg://
in reply to Billy O'Neal • • •Very Human Robot
in reply to daniel:// stenberg:// • • •What I do to get around this, is to base64 encode the keys in source, and then decode them at test time.
The secret scanners look for known strings, and don't base64 decode string literals...
daniel:// stenberg://
in reply to Very Human Robot • • •Jørn
in reply to daniel:// stenberg:// • • •Andrew
in reply to daniel:// stenberg:// • • •Shalien
in reply to daniel:// stenberg:// • • •Ondrej Moravek
in reply to daniel:// stenberg:// • • •"The security impact of this vulnerability is severe and multi-faceted:"
omg who talks like this? 😂
daniel:// stenberg://
in reply to Ondrej Moravek • • •Thomas Lee ✅
in reply to daniel:// stenberg:// • • •Thorsten Heit
in reply to daniel:// stenberg:// • • •ceejayoz
in reply to daniel:// stenberg:// • • •We got a CRITICAL security finding from a client the other day, saying we had TLS 1.0 enabled and a big bit about how bad this is demanding resolution.
They had split-horizon DNS for the whitelabeled subdomain and were scanning their own internal server, not ours.
Eicar Arlettaz
in reply to daniel:// stenberg:// • • •Sensitive content
y2k38
in reply to daniel:// stenberg:// • • •