CVE-2024-11053

What it actually does

Curl leaks the password (or login+password) stored in a .netrc entry for the redirect target hostname when instructed to both use .netrc credentials and follow HTTP redirects, sending the secret to the second host instead of only the original host.

Why it matters to the business

Organizations relying on curl for automated transfers risk exposing service or user credentials to attacker-controlled hosts, enabling unauthorized access to accounts or systems that share the leaked credentials.

How an attack unfolds

An attacker crafts a server response that issues an HTTP redirect to a hostname matching an existing .netrc entry (but lacking the password field), causing a curl client configured to follow redirects and read .netrc to transmit the original host's password in the Authorization header or equivalent to the attacker's host.

How to fix it

Upgrade curl to a build containing commit 75a2079d5c28debb2eaa848ca9430f1fe0d7844c or later; rebuild any statically linked applications or containers that embed the vulnerable curl version; audit and rotate any credentials that may have been exposed through .netrc usage with redirects.

How to confirm the fix worked

Confirm the installed curl binary reports a version built after commit 75a2079d5c28debb2eaa848ca9430f1fe0d7844c; test with a .netrc entry lacking password, a redirect, and packet capture or verbose logging to verify credentials are no longer sent to the redirect target.

Typical attack path

1. Attacker controls or compromises a host that curl is directed to contact first.
2. Server responds with an HTTP redirect to a second hostname that has a matching .netrc entry omitting the password.
3. Curl follows the redirect while still using .netrc credentials.
4. Password from the .netrc entry is sent to the redirect target.
5. Attacker captures the leaked credential for later use against the original service.

How to detect it

Review application and system logs for curl processes that performed HTTP redirects while a .netrc file was present; inspect network captures or verbose curl output for Authorization headers or credential fields sent to unexpected hostnames after a redirect; correlate with file-access logs showing reads of .netrc immediately before outbound connections.

What your security team should do

• Immediately upgrade all curl installations and dependent packages to the fixed commit.
• Disable .netrc usage or HTTP redirects in automated scripts where both are not strictly required.
• Scan codebases and CI pipelines for curl invocations that combine --netrc and redirect following.
• Rotate any passwords stored in .netrc files that were used with redirect-enabled transfers.
• Add curl version checks to vulnerability scanning and container image policies.