News for hackers. Stuff that matters.

A comment on CVE-2024-54471: Leaking Passwords (and More!) on macOS. Parent comment

Re:CVE-2024-54471: Leaking Passwords (and More!) on macOS by nmgycombinator on Thursday March 20, 2025 @06:59PM (#43430032)
> I understand the technical reasons for that, but it is technically supported by the spec and other clients work with it just fine.

I am completely aware of that, but I am aware that other clients handle it just fine. The bug actually forced me to use a different client for when I actually needed an FTP client.

[ Parent | on HN ]
Re:CVE-2024-54471: Leaking Passwords (and More!) on macOS by hunter2_ on Thursday March 20, 2025 @08:40PM (#43430701)
I would've guessed that once it's established that the bug is caused by the app injecting the specified username into the USERINFO portion of a URL without the necessary percent-encoding, a workaround (other than using a different client) would be to manually percent-encode the username, i.e., replace the "@" with "%40" ... although this wouldn't work if the app actually did percent-encode an entered "%" despite not encoding an entered "@"!
[ Parent | on HN ]
Re:CVE-2024-54471: Leaking Passwords (and More!) on macOS by nmgycombinator on Thursday March 20, 2025 @09:11PM (#43430882)
Fascinating. I'll have to test that out!
[ Parent | on HN ]