The curl and libcurl project has shaken the world recently with a critical vulnerability for CVE-2023-38545 that has been mitigated by the condition that will trigger this vulnerability.
Recently we released two article on the vulnerability CVE-2023-38545 and how to fix curl vulnerability in various systems. This flaw could potentially cause a heap overflow, putting countless systems at risk. In this blog post, we’ll delve into the details of this vulnerability, its impact, and the steps taken to mitigate it.
Update on curl, Libcurl
OCTOBER 11, 2023 DANIEL STENBERG 9 COMMENTS In association with the release of curl 8.4.0, we publish a security advisory and all the details for CVE-2023-38545. This problem is the worst security problem found in curl in a long time. We set it to severity HIGH. At the same time, the advisory contains all the necessary details. I figured I would use a few additional words and expand the explanations for anyone who cares to understand how this flaw works and how it happened. Background curl has supported SOCKS5 since August 2002. SOCKS5 is a proxy protocol. It is a rather simple protocol for setting up network communication via a dedicated “middle man”. The protocol is for example, typically used when setting up communication to get done over Tor but also for accessing the Internet from within organizations and companies.
What is curl and how is it related to libcurl?
libcurl is a free and easy-to-use client-side URL transfer library, supporting a wide range of protocols like HTTP, HTTPS, FTP, and more. It is widely used in various applications and systems, making any vulnerability in libcurl a cause for concern.
The curl Vulnerability: CVE-2023-38545
Background
The vulnerability was related to libcurl’s support for the SOCKS5 proxy protocol. A local variable, socks5_resolve_local, was improperly managed, leading to a heap overflow condition. This could be exploited by an attacker who controls an HTTPS server accessed over a SOCKS5 proxy.
Complexity of the Attack
While the vulnerability is severe, exploiting it is not straightforward. The attacker needs to deliver a URL that will lead to the overflow. This makes the attack less direct compared to vulnerabilities where the remote end could trigger the overflow directly. If the flaw were in the HTTP/HTTPS protocols without the involvement of a SOCKS5 proxy, it would be considered a critical vulnerability.
This bug was introduced when the SOCKS5 handshake code was converted from a blocking function into a non-blocking state machine.
The analysis in this section is specific to curl version 8. Some older versions of curl version 7 have less restriction on hostname length and/or a smaller SOCKS negotiation buffer size that cannot be overridden by CURLOPT_BUFFERSIZE.
The options that cause SOCKS5 with remote hostname to be used in libcurl:
CURLOPT_PROXYTYPEset to typeCURLPROXY_SOCKS5_HOSTNAME, or:CURLOPT_PROXYorCURLOPT_PRE_PROXYset to use the schemesocks5h://- One of the proxy environment variables can be set to use the
socks5h://scheme. For examplehttp_proxy,HTTPS_PROXYorALL_PROXY.
The urgency of the Issue for curl
The flaw was discovered through code review in approximately two hours, once the area of the code containing the flaw was identified. This highlights the urgency of releasing a fix for this vulnerability.
Analysis of the previous year’s vulnerabilities
- Yearly Frequency: On average, you can expect about 0.26 vulnerabilities to be reported yearly. Again, the sample data might not be fully representative.
- Common Type of Vulnerabilities: The most common type of vulnerability is… actually not specified (
None) in the majority of the records. It occurs 5 times in the truncated dataset. If we’re talking about specified types,libis the only one mentioned. - Severity of Vulnerabilities: The severity label that appears most frequently is ‘H’ (High), which occurs 3 times in the truncated dataset.
- Critical vulnerabilities were rare and only appeared in a few years like 2000, 2013.
- High vulnerabilities were more frequent around 2016.
- Medium vulnerabilities had a noticeable peak in 2016 and 2022.
- Low vulnerabilities have been on the rise, especially in recent years like 2022 and 2023.
Curl and libcurl Additional Flaw with mitigations
Interestingly, another flaw was discovered in the code, but it has no security impact. The state CONNECT_SOCKS_INIT lacks an intermediate CONNECT_SOCKS_INIT_SEND state. This leads to the whole initial packet being resent if a partial write happens, causing incorrect protocol communication towards the SOCKS5 proxy. This issue will likely be handled separately to avoid drawing attention to the area of the security flaw.
Curl and libcurl Affected Versions
- Affected versions: libcurl 7.69.0 to and including 8.3.0
- Not affected versions: libcurl < 7.69.0 and >= 8.4.0
- Introduced-in: https://github.com/curl/curl/commit/4a4b63daaa
libcurl is used by many applications, but not always advertised as such!
Curl and libcurl Upgrade and Mitigations
Starting in curl 8.4.0, curl no longer switches to local resolve mode if the name is too long but is instead rightfully returning an error.
Patch collection for older versions
RECOMMENDATIONS
A – Upgrade curl to version 8.4.0
B – Apply the patch to your local version
C – Do not use CURLPROXY_SOCKS5_HOSTNAME proxies with curl
D – Do not set a proxy environment variable to socks5h://
What is the exploitation data behind CVE-2023-38545 and CVE-2023-38546 In the wild?
CVSS: 10 -> 7.4 -> 4.4
CTI interest: Low 0.81
RCE Type Remote: Low probability (potential local authentication)
Availability: Yes
Status: Disclosed
EPSS Score: – not registered –
Currently, there are 2673 systems with some version of curl exposed, but considering curl is embedded in every window, mac, linux version and container used like Amazon the spread and surface could be quite vaste
Conclusion
The libcurl vulnerability, CVE-2023-38545, was a high-severity issue that required immediate attention. While the complexity of exploiting this vulnerability is high, the urgency of fixing it cannot be overstated. Additional flaws in the code, although not security-related, also need to be addressed in due course.
This vulnerability is embedded in a lot of packages, and system native calls (linux, mac) vendors might release this vulnerability in phases.
How Phoenix Security Can Help
Phoenix Security helps organizations identify and trace which systems have vulnerabilities, understanding the relation between code and cloud. One of the significant challenges in securing applications is knowing where and how frameworks like Struts are used. ASPM tools can scan the application portfolio to identify instances of Struts, mapping out where it is deployed across the organization. This information is crucial for targeted security measures and efficient patch management. Phoenix Security’s robust Application Security Posture Management (ASPM) system is adept at not just managing, but preempting the exploitation of vulnerabilities through its automated identification system. This system prioritises critical vulnerabilities, ensuring that teams can address the most pressing threats first, optimising resource allocation and remediation efforts.
The Role of Application Security Posture Management (ASPM):
ASPM plays a vital role in managing and securing applications like those built with Apache Struts. It involves continuous assessment, monitoring, and improvement of the security posture of applications. ASPM tools can:
- Identify and Track Struts Components: Locate where Struts is implemented within the application infrastructure.
- Vulnerability Management: Detect known vulnerabilities in Struts and prioritize them for remediation.
- Configuration Monitoring: Ensure Struts configurations adhere to best security practices.
- Compliance: Check if the usage of Struts aligns with relevant cybersecurity regulations and standards.
By leveraging Phoenix Security, you not only unravel the potential threats but also take a significant stride in vulnerability management, ensuring your application security remains up to date and focuses on the key vulnerabilities.
Get in control of your Application Security posture and Vulnerability management
Previous Issues of Vulnerability Weekly
- How to update curl and libcurl without panic fixing
- Critical Vulnerabilities in Atlassian Confluence: Zero-Day
- Detect & Mitigate HTTP/2: Rapid Reset Vulnerabilities
- Understanding the libcue Vulnerability CVE-2023
- Understanding and fixing Curl and libcurl
- CVE-2023-3519 Update on Critical RCE in Netscaler ADC (Citrix ADC) and Netscaler Gateway (Citrix Gateway) details on vulnerability timeline and compromise
- MOVEit Transfer breach, Zellis compromise CVE-2023-34362
