CVE-2025-0167

What it actually does

Curl leaks the password associated with a netrc default entry (lacking explicit login and password) to the destination host when processing an HTTP redirect after authenticating to the initial host.

Why it matters to the business

Organizations relying on curl for automated transfers risk unintended exposure of stored credentials to untrusted hosts, potentially enabling account compromise or further lateral movement in environments that use netrc defaults.

How an attack unfolds

An attacker hosts a page that issues an HTTP redirect to a controlled server, crafts a minimal netrc file containing only a default entry without credentials, and invokes curl with both --netrc and --location options against an initial target; curl then supplies the first host's password to the redirect target.

How to fix it

Upgrade curl to the version containing commit 34cf9d54a46598c44938aa7598820484d7af7133 or later; avoid netrc default entries that omit both login and password; consider disabling automatic redirect following when netrc is in use.

How to confirm the fix worked

Confirm the installed curl binary reports a version after the referenced commit; test with a controlled redirect and netrc default entry to verify credentials are no longer forwarded; review build or package manifests for the patched commit hash.

Typical attack path

1. Place a minimal default entry (no login or password) in the user's netrc file
2. Invoke curl with netrc and follow-redirects flags against an initial host
3. Initial host returns an HTTP redirect to an attacker-controlled endpoint
4. Curl forwards the original password in the Authorization header to the redirect target

How to detect it

Search web proxy, curl invocation, and command-line history logs for processes using both netrc and location flags together with subsequent requests to unexpected hosts; inspect netrc files for default entries lacking login and password fields.

What your security team should do

• Prioritize patching all curl installations to the fixed commit within standard change windows
• Audit scripts and automation for combined use of netrc and redirect following
• Replace netrc default entries with explicit per-host login/password pairs
• Monitor EPSS trend and reassess if exploit maturity increases