Skip to main content

Cool bug 🪳

Incorrect Type Conversion in interpreting IPv4-mapped IPv6 addresses in #curl results in indeterminate SSRF #vulnerabilities.

hackerone.com/reports/2493548


curl disclosed on HackerOne: Incorrect Type Conversion in...

## Summary: Octal Type Handling of Errors in IPv4 Mapped IPv6 Addresses in curl allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many programs that...
HackerOne
#curl #vulnerabilities
in reply to Marco Ivaldi

daniel:// stenberg://
daniel:// stenberg://
• •
the only bug there is if someone is foolish enough to filter on such URLs ...
⇧