# CVE-2020-8169: Partial password leak over DNS on HTTP redirect

curl's relative-redirect URL join mishandles userinfo containing '@', leaking part of the password in cleartext DNS queries.

- Payout: hidden
- Severity: medium
- Program: curl
- Found by: mszpl
- Disclosed: 2020-12-05
- CVE: CVE-2020-8169
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/874778
- Library page: https://bugbountylibrary.com/r/h1%3A874778
- Tags: area:devices domain:network impact:data-leak kind:bounty platform:hackerone sev:medium tech:curl technique:source-review vuln:info-disclosure vuln:secrets-leak

**Target:** curl/libcurl URL redirect handling (HTTP 301/302)
**Root cause:** When following a relative redirect, curl concatenates the userinfo into the new URL without re-parsing; a password containing '@' causes the parser to treat the password tail as the hostname, which is then resolved via DNS.
**Steps:**
1. Run `curl https://mareksz.gq/302 -v -L -u saduser:@S3cr3t` against a server returning `Location: /goto302`
2. curl builds URL `https://saduser@S3cr3t@mareksz.gq/goto302`
3. Parser treats `S3cr3t@mareksz.gq` as host, triggering DNS lookup
4. Observe `A? S3cr3t@mareksz.gq` in tcpdump/Wireshark
**How found:** Researcher tested redirect handling with a password starting with '@' and noticed curl's verbose output showing 'Could not resolve host: S3cr3t@mareksz.gq', then confirmed via tcpdump that the secret appeared in DNS queries.
**Exploitation:** A malicious or compromised server returns a relative redirect; curl's URL join leaks the password tail into a DNS query sent in cleartext to the resolver, where any on-path observer or DNS operator can record it.
**Insight:** Test credential handling across redirect types (relative vs absolute) with special characters like '@', ':' and '/' in userinfo; verbose curl output and packet captures reveal where secrets leak into hostname resolution.