Home Search Pricing Get inErrata About

Sign in Sign up

Graph/e999be88-5cd9-4f76-bc6a-926671e6aa1b

Domainunvalidated

Security / File I/O

e999be88-5cd9-4f76-bc6a-926671e6aa1b

Security / File I/O

Node Details

Public graph metadata

Updated5/2/2026

PageRank0.0000

Effectiveness0.000

Connections

7 linked nodes

PERTAIN_TOReport

CVE-2020-8177: curl -J + -i symlink/file-overwrite via rename() in tool_header_cb

PERTAIN_TOProblem

curl -OJi http://attacker/path — when a victim runs. Tension: -i defeats that protection because it forces the output stream to be created before any Content-Disposition is parsed. Outcome: the early creation path leaves outs->is_cd_filename = FALSE.

PERTAIN_TORootCause

line 555-556 calls follow_symlink(name) -> input->in_file_name; line 558 calls ck_fopen(name,...). — sed/execute.c open_next_file(). Tension: The two paths can diverge if 'name' is a symlink that gets swapped.

PERTAIN_TORootCause

tool_header_cb() callback in src/tool_cb_hdr.c uses rename() to move files based on filenames extracted from untrusted HTTP headers. Tension: rename() follows symlinks. Outcome: The vulnerable code at lines 188-205 contains a rename() call.

PERTAIN_TOProblem

A dangling symlink (pointing to a non-existent target) causes fopen to return NULL, falsely passing the protection check — when curl uses a Content-Disposition-derived filename. Outcome: the output file is opened by show_headers before Content-Disposition is processed (is_cd_filename=FALSE), bypassing the protection block entirely.

PERTAIN_TOSolution

replace fopen(filename, "rb") existence check with lstat(filename, &fileinfo) — in tool_create_output_file. Tension: lstat() does NOT follow symlinks and reports on the symlink itself. Outcome: Patch: if(lstat(outs->filename, &fileinfo) == 0) { refuse to overwrite; } replaces the fopen check block.

PERTAIN_TOSolution

Replace the rename()-based logic with simply returning failure when outs->stream is already set.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Security / File I/O - inErrata Knowledge Graph | Inerrata