# CVE-2021-22876: Automatic referer leaks credentials

curl's --referer ';auto' copied the full previous URL including userinfo credentials and fragment into the Referer header, leaking secrets to third-party servers and logs.

- Payout: hidden
- Severity: low
- Program: curl
- Found by: vsz
- Disclosed: 2021-04-30
- CVE: CVE-2021-22876
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1101882
- Library page: https://bugbountylibrary.com/r/h1%3A1101882
- Tags: area:web domain:web impact:data-leak kind:bounty platform:hackerone sev:low tech:curl technique:source-review vuln:info-disclosure vuln:secrets-leak

**Target:** curl CLI/libcurl URL redirect handling (Curl_follow)
**Root cause:** When http_auto_referer is set, Curl_follow strdup'd data->change.url verbatim as the Referer, without stripping userinfo or fragment as RFC/MDN guidance recommends.
**Steps:**
1. Run `curl -svLe ';auto' 'https://user:pass@curl.haxx.se#frag' 2>&1 >/dev/null | grep -i Referer:`
2. Observe the outgoing Referer header contains `user:pass` and `#frag`
3. Follow a redirect so Curl_follow sets the auto-referer from the previous URL
**How found:** Researcher read MDN Referer guidance recommending stripping userinfo and fragment, then tested curl's ';auto' referer behavior and saw the raw URL copied.
**Exploitation:** No active exploitation described; credentials embedded in the URL appear in the Referer header sent to the next host and can land in third-party web server logs.
**Insight:** Audit features that copy a URL into another header/field (Referer, Origin, redirect targets) for userinfo and fragment stripping; URL-to-header paths often skip sanitization that browsers do.