Curl Vulnerability Allows Unauthorized Access via IPFS URLs

• •Curl's vulnerability allows crafted IPFS URLs to escape gateway namespaces.
• •Exploitation requires specific conditions, including authenticated gateway access.
• •Curl's security team classified the issue as informative, not a critical vulnerability.

A researcher disclosed a vulnerability in curl's handling of IPFS and IPNS URLs that allows crafted URLs to escape the configured gateway namespace. This issue affects curl versions starting from 8.5.0, including 8.22.0. By exploiting this flaw, an attacker could potentially cause curl to request sensitive paths on the same server, such as '/admin/config', while retaining authentication headers. The exploitation requires specific conditions, including the application accepting attacker-controlled URLs and using curl through an authenticated gateway. Curl's security team classified the report as informative rather than a critical vulnerability, emphasizing that the gateway must enforce its own access controls. A proposed fix has been submitted, but the vulnerability remains unclassified as a security flaw in curl itself. Users are advised to validate IPFS and IPNS URLs before passing them to authenticated gateways.