CURL-CVE-2022-30115

Dashboard / Vulnerabilities / CURL-CVE-2022-30115

CURL-CVE-2022-30115

Summary: HSTS bypass via trailing dot

Details: curl's HSTS check could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This mechanism could be bypassed if the hostname in the given URL used a trailing dot while not using one when it built the HSTS cache. Or the other way around - by having the trailing dot in the HSTS cache and *not* using the trailing dot in the URL. Since trailing dots in hostnames are somewhat special, many sites work equally fine with or without a trailing dot present.

References: