Executive Summary

The vulnerability in curl's websocket code is that it did not update the 32-bit mask pattern for each new outgoing frame as required by the specification. Instead, it used a fixed mask that persisted throughout the entire connection. This predictable mask pattern can be exploited by a malicious server to induce traffic that a proxy might interpret as genuine HTTP traffic, leading to cache poisoning.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a malicious server to poison the cache of a proxy by sending traffic that appears as legitimate HTTP content. The poisoned cache content could then be served to all users of that proxy, potentially exposing them to malicious or incorrect data.

Useful 0 Not Useful 0