CVEs-PoC/2016/CVE-2016-8624.md

### [CVE-2016-8624](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8624)
![](https://img.shields.io/static/v1?label=Product&message=curl&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=7.51.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20&color=brightgreen)

### Description

curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them.

### POC

#### Reference
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://hackerone.com/reports/180434

#### Github
- https://github.com/RClueX/Hackerone-Reports
- https://github.com/fokypoky/places-list
- https://github.com/imhunterand/hackerone-publicy-disclosed
- https://github.com/pankajkryadav/Hacktivity