CVE-2016-0754

cURL before 7.47.0 on Windows allows attackers to write to arbitrary files in the current working directory on a different drive via a colon in a remote file name.

cURL before 7.47.0 on Windows allows attackers to write to arbitrary files in the current working directory on a different drive via a colon in a remote file name.

cURL before 7.47.0 on Windows allows attackers to write to arbitrary files in the current working directory on a different drive via a colon in a remote file name.

cURL before 7.47.0 on Windows allows attackers to write to arbitrary files in the current working directory on a different drive via a colon in a remote file name.

cURL before 7.47.0 on Windows allows attackers to write to arbitrary files in the current working directory on a different drive via a colon in a remote file name.

curl does not sanitize colons in a remote filename that is used as the local filename. This may lead to a vulnerability on systems where the colon is a special path character. Currently Windows is the only OS where this vulnerability applies.

curl offers command line options --remote-name (also usable as -O) and --remote-header-name (also usable as -J). When both of those options are used together (-OJ) and the server provides a remote filename for the content, curl writes its output to that server-provided filename, as long as that file does not already exist. If it does exist curl fails to write.

If both options are used together (-OJ) but the server does not provide a remote filename, or if -O is used without -J, curl writes output to a filename based solely on the remote filename in the URL string provided by the user, regardless of whether or not that file already exists.

In either case curl does not sanitize colons in the filename. As a result in Windows it is possible and unintended behavior for curl to write to a file in the working directory of a drive that is not the current drive (i.e. outside the current working directory), and also possible to write to a file's alternate data stream.

For example if curl -OJ and the server sends filename=f:foo curl incorrectly writes foo to the working directory for drive F even if drive F is not the current drive. For a more detailed explanation see the 'MORE BACKGROUND AND EXAMPLE' section towards the end of this advisory.

Though no known exploit is available for this issue at the time of the publication, writing one would be undemanding and could be serious depending on the name of the file and where it ends up being written.