Weblate wlc Command-Line Client SSL Verification Vulnerability

A vulnerability in the Weblate command-line client, wlc, prior to version 1.17.0, allowed SSL verification to be skipped for certain crafted URLs. This issue could potentially lead to insecure connections by bypassing important security checks on SSL certificates.

Impact

Exploitation of this vulnerability could result in SSL verification being improperly skipped, allowing for insecure connections that could be exploited in man-in-the-middle attacks.

Reproduction

The vulnerability can be reproduced by using a version of the wlc command-line client prior to 1.17.0 and providing a crafted URL that exploits the SSL verification skip. This can be done by manipulating the URL to include a hostname that starts with '127.0.0.1', which would be incorrectly treated as a localhost address, bypassing SSL verification.

Remediation

Users can upgrade to wlc version 1.17.0 or later, where this vulnerability has been fixed.