Kamil Dudka

A vulnerability was found in csmock where a regular user of the OSH service, with a valid Kerberos ticket, can disclose the confidential Snyk authentication token and run arbitrary commands on OSH workers. The issue can be exploited through a local network attack vector.

The issue arises from an uninitialized random value in libcurl's internal function, which is used to generate nonces for Digest and NTLM authentication, boundary strings in HTTP formposts, and more. This weak or virtually non-existent random value makes the operations that use it vulnerable. The internal function was implemented poorly, overwriting the pointer instead of writing the value into the buffer the pointer pointed to.

The issue allows remote attackers to obtain sensitive information via unspecified vectors. This occurs when cURL and libcurl send the HTTP Basic authentication credentials for a previous connection when reusing a reset connection handle to send a request to the same host name. libcurl can wrongly send HTTP credentials when re-using connections, specifically when using the `curl easy reset()` function, which is supposed to clear the credentials but does not. This can lead to credentials being leaked in subsequent requests to the same hostname.