# CVE-2021-22923: Metalink download sends credentials

curl's --metalink mode reused --user credentials for all metalink-referenced transfers, leaking Basic auth to arbitrary hosts and cleartext http/ftp.

- Payout: hidden
- Severity: medium
- Program: curl
- Found by: nyymi
- Disclosed: 2021-07-21
- CVE: CVE-2021-22923
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1213181
- Library page: https://bugbountylibrary.com/r/h1%3A1213181
- Tags: area:oss domain:oss impact:data-leak kind:bounty platform:hackerone sev:medium tech:curl technique:source-review vuln:info-disclosure vuln:secrets-leak

**Target:** curl CLI/libcurl metalink downloader
**Root cause:** Metalink-referenced URLs inherit the --user credentials without host/protocol restriction, unlike redirects which only forward creds with --location-trusted.
**Steps:**
1. Build libcurl with `--with-libmetalink`
2. Create metalinktest.xml with a `<url>` pointing to a different host over `http`
3. Run `curl --metalink --user professor:Joshua https://testsite/metalinktest.xml`
4. Observe `Authorization: Basic cHJvZmVzc29yOkpvc2h1YQ==` sent to the foreign host over cleartext
**How found:** Noticed metalink transfers behaved unlike redirects, which withhold credentials from other hosts unless --location-trusted is set; tested a metalink file referencing a different http host and saw the Authorization header leak.
**Exploitation:** Attacker in MITM position or the foreign host itself captures the Basic auth header sent in cleartext to the metalink-referenced URL.
**Insight:** When a feature spawns secondary transfers from a user-supplied document (metalink, manifests, playlists), check whether the primary request's auth is scoped to the original host or blindly reused for every derived URL.