It has been revealed that it is possible to create any computable functions using constructs in the configuration files of the Curl utility. This feature appears only in versions of Curl from 8.12-8.16 and is caused by the unintentional implementation of completeness according to Turing, which allows you to create machines Turing, using the ability to extract byte ranges from variable values and unlimited nesting depth when connecting external configuration files.
As an example, using Curl, a simulation of the operation of a two-counter register machine (Minsky machines) for adding numbers and implementing the program “99 bottles of beer“, used in teaching loops. To run a program programmed through curl configuration files, simply unpack the archive and execute the command “curl -q -s -K 99_bottles/main.conf”.
The register machine is simulated by representing the counter value as a string of “n” “x” characters. Increment and decrement operations are implemented through string concatenation and truncation (syntax “[0-0]” to leave the first byte and “[1-]” to leave everything except the first byte), and transitions between states are controlled by the “expand-config” directive, which dynamically loads the next configuration file using its name as a transition label. The INC(R) operation in the register engine is implemented as ‘expand-variable = “r={{r}}x”‘ in the Curl configuration file, DEC(R) is implemented as ‘expand-variable = “r[1-]={{r}}”‘, and JMP(S) is implemented as ‘expand-config = “S.conf”‘. For example, code to calculate 2 + 3:
In practice, the computing capabilities implemented through configuration files are limited by the size of the stack, since each step of program execution requires loading a new attached configuration file. With an 8MB stack, the overflow occurs after approximately 922 steps. The capabilities are also affected by the limitation on the size of exposed variables (the MAX_EXPAND_CONTENT parameter is set to 10 MB) and the large memory consumption due to saving all old versions of the variables.
Despite the fact that the identified feature is not a vulnerability in versions starting from curl 8.17 the trick in question is already will not work due to limitation depth of nesting of configuration files 5 levels to protect against infinite recursion.