CVE-2025-0167: Haxx Curl Information Disclosure Flaw

CVE-2025-0167 Overview

CVE-2025-0167 is an information leakage vulnerability in Haxx curl that can expose credentials stored in .netrc files when HTTP redirects are followed. When curl is configured to use a .netrc file for credentials and is instructed to follow HTTP redirects, it may inadvertently leak the password used for the first host to subsequent redirect destinations under specific circumstances.

This vulnerability manifests only when the .netrc file contains a default entry that omits both login and password fields—a rare but possible configuration scenario.

Critical Impact

Credentials intended for one host may be transmitted to unintended destinations during HTTP redirect sequences, potentially exposing sensitive authentication data to malicious or unauthorized servers.

Affected Products

• Haxx curl (multiple versions)
• NetApp ONTAP 9
• NetApp Element Software
• NetApp ONTAP Select Deploy Administration Utility
• NetApp ONTAP Tools 9 for VMware vSphere
• NetApp SolidFire & HCI Management Node
• NetApp SolidFire & HCI Storage Node
• NetApp Bootstrap OS
• NetApp HCI Compute Node
• NetApp H-Series Hardware (H300S, H410C, H410S, H500S, H610C, H610S, H615C, H700S) and associated firmware

Discovery Timeline

• February 5, 2025 - CVE-2025-0167 published to NVD
• July 30, 2025 - Last updated in NVD database

Technical Details for CVE-2025-0167

Vulnerability Analysis

This vulnerability represents an information leakage issue in curl's credential handling mechanism when processing .netrc files in conjunction with HTTP redirects. The flaw occurs during the authentication flow when curl follows redirects between different hosts.

Under normal operation, curl should scope credentials to specific hosts as defined in the .netrc file. However, when a .netrc file contains a default entry without explicit login and password fields, curl's credential resolution logic can incorrectly apply credentials from the initial request host to subsequent redirect destinations.

The exploitability requires several conditions to align: the target must be using .netrc for authentication, redirect following must be enabled, and the .netrc configuration must contain a specific malformed default entry. While this combination represents a narrow attack surface, the potential impact of credential exposure warrants attention in environments where these conditions may exist.

Root Cause

The root cause stems from improper credential scoping in curl's .netrc parsing and redirect handling logic. When processing redirects, curl fails to properly re-evaluate which credentials from the .netrc file should apply to the new destination host. This results in credentials being carried forward across host boundaries when the .netrc file contains a default entry that lacks complete authentication parameters.

Attack Vector

An attacker could potentially exploit this vulnerability by controlling or compromising a redirect destination. In this scenario:

1. A legitimate service initiates an HTTP request using curl with .netrc credentials
2. The attacker induces or controls a redirect to a malicious server
3. Due to the vulnerability, curl transmits the original host's password to the redirect destination
4. The attacker captures the leaked credentials

The attack requires network-level access and depends on the victim's specific .netrc configuration, making exploitation challenging but not impossible in targeted attack scenarios.

The vulnerability mechanism involves curl's credential handling during redirect sequences. When a .netrc file with a bare default entry is used and redirects are followed, the password from the original host may be transmitted to the redirect target. Technical details are available in the cURL CVE-2025-0167 Documentation.

Detection Methods for CVE-2025-0167

Indicators of Compromise

• Unusual outbound HTTP requests containing authentication headers directed to unexpected destinations
• Network traffic patterns showing redirects from legitimate services to untrusted external hosts
• Log entries indicating credential transmission to hosts not defined in .netrc files

Detection Strategies

• Monitor curl command invocations that use both -n/--netrc and -L/--location flags simultaneously
• Analyze .netrc files for default entries that omit login or password fields
• Implement network traffic analysis to detect credential leakage across redirect chains
• Review application logs for unexpected authentication attempts to third-party services

Monitoring Recommendations

• Deploy network monitoring to track HTTP redirect chains originating from systems using curl
• Implement endpoint detection rules for processes accessing .netrc files
• Configure alerting for outbound connections following redirects to previously unknown hosts
• Audit systems for curl configurations that enable both .netrc usage and redirect following

How to Mitigate CVE-2025-0167

Immediate Actions Required

• Update curl to the latest patched version available from Haxx
• Review and audit all .netrc files for improperly configured default entries
• Ensure all .netrc entries include explicit login and password fields or remove incomplete default entries
• Consider disabling automatic redirect following where not strictly necessary

Patch Information

Haxx has released security updates addressing this vulnerability. Organizations should consult the cURL CVE-2025-0167 Documentation for specific version information and download links.

For NetApp products, refer to the NetApp Security Advisory NTAP-20250306-0008 for product-specific patch availability and guidance.

Workarounds

• Remove or correct any default entries in .netrc files that omit login and password fields
• Use explicit host-specific entries in .netrc files instead of default entries
• Disable redirect following by avoiding the -L/--location flag when using .netrc authentication
• Use alternative authentication methods such as explicit credentials or token-based authentication where feasible

# Configuration example
# Review and fix .netrc files - ensure all entries have complete credentials
# Incorrect (vulnerable):
# default

# Correct (specify complete credentials for each host):
# machine example.com login myuser password mypassword

# Alternatively, disable redirect following when using .netrc:
curl --netrc --max-redirs 0 https://example.com/api