aboutsummaryrefslogtreecommitdiff
path: root/docs/libcurl
diff options
context:
space:
mode:
authorDaniel Stenberg <daniel@haxx.se>2018-02-13 13:54:11 +0100
committerDaniel Stenberg <daniel@haxx.se>2018-02-13 13:54:11 +0100
commit1e720400aaab007f7b06099f94c09ea0d59036e7 (patch)
treefc7df9f32a73fbbaeb101b38f60d01a84ca59cf1 /docs/libcurl
parent03b7b2e8fc786f090599b6b4d32bb0c9cc03165a (diff)
libcurl-security.3: the http://192.168.0.1/my_router_config case
Mentioned-By: Rich Moore
Diffstat (limited to 'docs/libcurl')
-rw-r--r--docs/libcurl/libcurl-security.37
1 files changed, 6 insertions, 1 deletions
diff --git a/docs/libcurl/libcurl-security.3 b/docs/libcurl/libcurl-security.3
index 3334d581c..185fb6b08 100644
--- a/docs/libcurl/libcurl-security.3
+++ b/docs/libcurl/libcurl-security.3
@@ -151,6 +151,11 @@ address and port number for a server local to the app running libcurl but
behind a firewall. Applications can mitigate against this by using the
\fICURLOPT_FTP_SKIP_PASV_IP(3)\fP option or \fICURLOPT_FTPPORT(3)\fP.
+Local servers sometimes assume local access comes from friends and trusted
+users. An application that expects http://example.com/file_to_read that and
+instead gets http://192.168.0.1/my_router_config might print a file that would
+otherwise be protected by the firewall.
+
Allowing your application to connect to local hosts, be it the same machine
that runs the application or a machine on the same local network, might be
possible to exploit by an attacker who then perhaps can "port-scan" the
@@ -303,7 +308,7 @@ enabled by applications that fail to properly validate server TLS/SSL
certificates, thus enabling a malicious server to spoof a legitimate
one. HTTPS without validated certificates is potentially as insecure as a
plain HTTP connection.
-.SH "Resport Security Problems"
+.SH "Report Security Problems"
Should you detect or just suspect a security problem in libcurl or curl,
contact the project curl security team immediately. See the separate
SECURITY.md document for details.