# CVE-2022-27780: percent-encoded path separator in URL host

curl's URL parser accepted percent-encoded '/' in the host, so `http://example.com%2F127.0.0.1/` was fetched as `http://example.com/127.0.0.1/`, bypassing URL filters.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: haxatron1
- Disclosed: 2022-06-11
- CVE: CVE-2022-27780
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1565619
- Library page: https://bugbountylibrary.com/r/h1%3A1565619
- Tags: area:oss domain:oss impact:integrity kind:bounty platform:hackerone sev:medium tech:curl technique:parser-differential vuln:misconfiguration vuln:ssrf

**Target:** curl/libcurl URL parser (host name decoding)
**Root cause:** The URL parser percent-decodes the host name but does not reject decoded bytes that are URL separator characters like '/', so the host boundary shifts after parsing.
**Steps:**
1. Pass `http://example.com%2F127.0.0.1/` to curl
2. Parser accepts the percent-encoded host and decodes `%2F` to `/`
3. Resulting URL is transposed to `http://example.com/127.0.0.1/`, a different host/path than the filter expected
**How found:** Researcher examined curl's newly added percent-encoded host name support (commit 9a8564a920188e, 7.80.0) and tested whether encoded separators in the host were rejected.
**Exploitation:** A filter or allowlist that inspects the URL string sees host `example.com%2F127.0.0.1` while curl actually connects to `example.com` with path `/127.0.0.1/`, enabling SSRF/allowlist bypass in applications relying on curl's parsing.
**Insight:** When a parser adds percent-decoding to a component, test whether decoded bytes can introduce structural delimiters ('/', '@', '?', '#') that change how the URL is later split — the classic parser-differential filter bypass.