Skip to main content

I was reminded of the great #Cisco security fix of 2019

#curl

a config file showing how it returns a 403 error if the user agent contains the word "curl"
#curl #cisco
This entry was edited (7 months ago)
in reply to daniel:// stenberg://

Yaksh Bariya
Yaksh Bariya
• •

This is ofcourse going the obvious solution when your blog's "network engineer" tag is filled with PR BS:

CW: everything on this blog is bullshit, and unrelated to what the tag name is

blogs.cisco.com/tag/network-en…


network engineer - Cisco Blogs

Cisco Systems
in reply to daniel:// stenberg://

Karl Fredrik 🦊
Karl Fredrik 🦊
• •

This is sorta what imgur does for wget as well, to "stop" scraping I guess...

(it has returned 429 "too many requests" every time I've tried, so I assumme it's an ingress rule for the user agent)

Linux terminal. The first command attempts to run `wget` to download a file from Imgur. The command returns HTTP error 429 (too many requests). The second command works, and contains the flag --user-agent="curl"
in reply to daniel:// stenberg://

Martin Rocket
Martin Rocket
• •
So many servers are happy when you just provide a trusted user-agent, and a referer. Sometimes one alao needs a token that can be obtaimed from an additional request.
in reply to daniel:// stenberg://

Troed Sångberg
Troed Sångberg
• •
This should be the first hit on Google when searching for "imposter syndrome".
in reply to daniel:// stenberg://

Sandor Szücs
Sandor Szücs
• •
to buy cisco is just sick: expensive and you see the "quality" of their sophisticated "security" devices.
How can they play with their reputation like this...
in reply to daniel:// stenberg://

Tito Swineflu
Tito Swineflu
• •
If it just piped the offending IP address into the iptables drop list, it would be a good start. No reason to let your adversary know they can try again with different parameters.
in reply to daniel:// stenberg://

srslypascal
srslypascal
• •
Same nonsense on dl.dell.com - the default user agents of curl and wget trigger a 403 error, but setting the user agent to a less suspicious string such as "bullshit" or "nmap" solves the problem.

FTP Root

dl.dell.com
This entry was edited (7 months ago)
in reply to daniel:// stenberg://

Michelle Hughes
Michelle Hughes
• •
We won't let you hack into this device unless you ask *politely*! That will stop hackers because the evil in their hearts prevents them from being polite.
in reply to daniel:// stenberg://

Asharas
Asharas
• •
Last time I checked supervisord's documentation website did the same, couldn't get an answer with curl until I try with another UA.
in reply to daniel:// stenberg://

Jason Sando
Jason Sando
• •
this hit so close to home today ... been struggling with an infrastructure team having a basic auth protected service redirecting https to http. Gave then curl screenshots and their response was "we are not familiar with this 'curl' software, can you try it on Chrome or Edge?" 😔😒🤨
in reply to daniel:// stenberg://

daniel:// stenberg://
daniel:// stenberg://
• •

I posted this image on LinkedIn as well, and the stats there tells me that Cisco is in fact now the third most common employing company among the viewers... (only beaten by AWS and Microsoft)

linkedin.com/posts/danielstenb…


Daniel Stenberg on LinkedIn: #curl | 37 comments

Never forget this awesome security fix of 2019 when Cisco fixed their vulnerable RV320/325 routers. #curl | 37 comments on LinkedIn
Daniel Stenberg (www.linkedin.com)
in reply to daniel:// stenberg://

spmatich
spmatich
• •
does this qualify as code bloat? the user agent header is completely arbitrary and can be set to anything.
I mean why single out curl. Shouldn’t the nmap default user agent be in there too? etc etc
in reply to spmatich

daniel:// stenberg://
daniel:// stenberg://
• •
@spmatich they singled out curl because the exploit proof of concept used curl. They stopped the example command line from working.
@spmatich
in reply to daniel:// stenberg://

spmatich
spmatich
• •
so the exploit just needs an update to include setting the user agent header to something else right, and it could be one of many many many different strings.
in reply to daniel:// stenberg://

Gen X-Wing
Gen X-Wing
• •
This makes me want to add a check for curl as the user agent, but only so it sends back a fun message as part of the return headers. Something harmless.
⇧