romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 21:13:40 +03:00
Code Issues Projects Releases Packages Wiki Activity

tool_doswin: add stdin relay auth

Browse source 
Verify the peer with a random number in the background thread.

Closes #21467
This commit is contained in:
11soda11 2026-04-29 00:13:15 +02:00 • committed by Daniel Stenberg
parent a53bae7922
commit 057b251358
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
8 changed files with 113 additions and 80 deletions
Download patch file Download diff file Expand all files Collapse all files

15
docs/KNOWN_BUGS.md
View file

@ -105,21 +105,6 @@ would do if you used `-T` file.
See [curl issue 12171](https://github.com/curl/curl/issues/12171)
## Windows stdin relay accepts unauthenticated local connections
curl features a Windows-only stdin relay in `src/tool_doswin.c` that creates a
loopback TCP listener and spawns a thread to accept the first incoming
connection, then forwards stdin to it. There is no authentication or peer
validation on the accepted socket. A local attacker can race to connect to the
ephemeral loopback port (discoverable via local port enumeration/scan) before
curl connects, causing the thread to send stdin/upload data to the attacker or
to disrupt the transfer.
The function should verify the client-side with a random number similar to the
socketpair emulation function in libcurl. It cannot verify the source address
and port since there is this widespread habit on Windows to run tools that
MITM even local TCP connections for security.
# Build and portability issues
## OS400 port requires deprecated IBM library