blog

Are Libcurl and Curl bad? Mitigation to vulnerabilities CVE-2023-38545 and CVE-2023-38546

CVE-2023-38546, CVE-2023-38545 curl in the wild, libcurl, curl, vulnerability, application security, vulnerability management


CVE-2023-38546, CVE-2023-38545 curl in the wild, libcurl, curl, vulnerability, application security, vulnerability management

The curl and libcurl project has shaken the world recently with a critical vulnerability for CVE-2023-38545 that has been mitigated by the condition that will trigger this vulnerability.

Recently we released two article on the vulnerability CVE-2023-38545 and how to fix curl vulnerability in various systems. This flaw could potentially cause a heap overflow, putting countless systems at risk. In this blog post, we’ll delve into the details of this vulnerability, its impact, and the steps taken to mitigate it.

Update on curl, Libcurl


OCTOBER 11, 2023 DANIEL STENBERG 9 COMMENTS In association with the release of curl 8.4.0, we publish a security advisory and all the details for CVE-2023-38545. This problem is the worst security problem found in curl in a long time. We set it to severity HIGH. At the same time, the advisory contains all the necessary details. I figured I would use a few additional words and expand the explanations for anyone who cares to understand how this flaw works and how it happened. Background curl has supported SOCKS5 since August 2002. SOCKS5 is a proxy protocol. It is a rather simple protocol for setting up network communication via a dedicated “middle man”. The protocol is for example, typically used when setting up communication to get done over Tor but also for accessing the Internet from within organizations and companies.


What is curl and how is it related to libcurl?

libcurl is a free and easy-to-use client-side URL transfer library, supporting a wide range of protocols like HTTP, HTTPS, FTP, and more. It is widely used in various applications and systems, making any vulnerability in libcurl a cause for concern.

The curl Vulnerability: CVE-2023-38545

Background

The vulnerability was related to libcurl’s support for the SOCKS5 proxy protocol. A local variable, socks5_resolve_local, was improperly managed, leading to a heap overflow condition. This could be exploited by an attacker who controls an HTTPS server accessed over a SOCKS5 proxy.

Complexity of the Attack

While the vulnerability is severe, exploiting it is not straightforward. The attacker needs to deliver a URL that will lead to the overflow. This makes the attack less direct compared to vulnerabilities where the remote end could trigger the overflow directly. If the flaw were in the HTTP/HTTPS protocols without the involvement of a SOCKS5 proxy, it would be considered a critical vulnerability.

This bug was introduced when the SOCKS5 handshake code was converted from a blocking function into a non-blocking state machine.

The analysis in this section is specific to curl version 8. Some older versions of curl version 7 have less restriction on hostname length and/or a smaller SOCKS negotiation buffer size that cannot be overridden by CURLOPT_BUFFERSIZE.

The options that cause SOCKS5 with remote hostname to be used in libcurl:

  • CURLOPT_PROXYTYPE set to type CURLPROXY_SOCKS5_HOSTNAME, or:
  • CURLOPT_PROXY or CURLOPT_PRE_PROXY set to use the scheme socks5h://
  • One of the proxy environment variables can be set to use the socks5h:// scheme. For example http_proxyHTTPS_PROXY or ALL_PROXY.

The urgency of the Issue for curl

The flaw was discovered through code review in approximately two hours, once the area of the code containing the flaw was identified. This highlights the urgency of releasing a fix for this vulnerability.

Analysis of the previous year’s vulnerabilities

Vulnerabilites, Curl, libcurl, application security, vulnerability management

Credit curl report

  1. Yearly Frequency: On average, you can expect about 0.26 vulnerabilities to be reported yearly. Again, the sample data might not be fully representative.
  2. Common Type of Vulnerabilities: The most common type of vulnerability is… actually not specified (None) in the majority of the records. It occurs 5 times in the truncated dataset. If we’re talking about specified types, lib is the only one mentioned.
  3. Severity of Vulnerabilities: The severity label that appears most frequently is ‘H’ (High), which occurs 3 times in the truncated dataset.
  4. Critical vulnerabilities were rare and only appeared in a few years like 2000, 2013.
  5. High vulnerabilities were more frequent around 2016.
  6. Medium vulnerabilities had a noticeable peak in 2016 and 2022.
  7. Low vulnerabilities have been on the rise, especially in recent years like 2022 and 2023.

Curl and libcurl Additional Flaw with mitigations

Interestingly, another flaw was discovered in the code, but it has no security impact. The state CONNECT_SOCKS_INIT lacks an intermediate CONNECT_SOCKS_INIT_SEND state. This leads to the whole initial packet being resent if a partial write happens, causing incorrect protocol communication towards the SOCKS5 proxy. This issue will likely be handled separately to avoid drawing attention to the area of the security flaw.

Curl and libcurl Affected Versions

libcurl is used by many applications, but not always advertised as such!

Curl and libcurl Upgrade and Mitigations

Starting in curl 8.4.0, curl no longer switches to local resolve mode if the name is too long but is instead rightfully returning an error.

Patch collection for older versions

RECOMMENDATIONS

A – Upgrade curl to version 8.4.0

B – Apply the patch to your local version

C – Do not use CURLPROXY_SOCKS5_HOSTNAME proxies with curl

D – Do not set a proxy environment variable to socks5h://

What is the exploitation data behind CVE-2023-38545 and CVE-2023-38546 In the wild?

CVSS: 10 -> 7.4 -> 4.4

CTI interest: Low 0.81

RCE Type Remote: Low probability (potential local authentication)

Availability: Yes

Status: Disclosed

EPSS Score: – not registered –

Currently, there are 2673 systems with some version of curl exposed, but considering curl is embedded in every window, mac, linux version and container used like Amazon the spread and surface could be quite vaste

CVE-2023-38546, CVE-2023-38545 curl in the wild
CVE-2023-38546, CVE-2023-38545 curl in the wild, libcurl, curl, vulnerability, application security, vulnerability management

Conclusion

The libcurl vulnerability, CVE-2023-38545, was a high-severity issue that required immediate attention. While the complexity of exploiting this vulnerability is high, the urgency of fixing it cannot be overstated. Additional flaws in the code, although not security-related, also need to be addressed in due course.

This vulnerability is embedded in a lot of packages, and system native calls (linux, mac) vendors might release this vulnerability in phases.

How Phoenix Security Can Help

attack graph phoenix security
ASPM

Phoenix Security helps organizations identify and trace which systems have vulnerabilities, understanding the relation between code and cloud. One of the significant challenges in securing applications is knowing where and how frameworks like Struts are used. ASPM tools can scan the application portfolio to identify instances of Struts, mapping out where it is deployed across the organization. This information is crucial for targeted security measures and efficient patch management. Phoenix Security’s robust Application Security Posture Management (ASPM) system is adept at not just managing, but preempting the exploitation of vulnerabilities through its automated identification system. This system prioritises critical vulnerabilities, ensuring that teams can address the most pressing threats first, optimising resource allocation and remediation efforts.

The Role of Application Security Posture Management (ASPM):

ASPM plays a vital role in managing and securing applications like those built with Apache Struts. It involves continuous assessment, monitoring, and improvement of the security posture of applications. ASPM tools can:

  1. Identify and Track Struts Components: Locate where Struts is implemented within the application infrastructure.
  2. Vulnerability Management: Detect known vulnerabilities in Struts and prioritize them for remediation.
  3. Configuration Monitoring: Ensure Struts configurations adhere to best security practices.
  4. Compliance: Check if the usage of Struts aligns with relevant cybersecurity regulations and standards.

By leveraging Phoenix Security, you not only unravel the potential threats but also take a significant stride in vulnerability management, ensuring your application security remains up to date and focuses on the key vulnerabilities.

Get an overview of your asset lineage

Previous Issues of Vulnerability Weekly



Francesco is an internationally renowned public speaker, with multiple interviews in high-profile publications (eg. Forbes), and an author of numerous books and articles, who utilises his platform to evangelize the importance of Cloud security and cutting-edge technologies on a global scale.

Discuss this blog with our community on Slack

Join our AppSec Phoenix community on Slack to discuss this blog and other news with our professional security team

From our Blog

Explore ASPM’s role in modern application security, offering a panoramic view that extends beyond code vulnerabilities. This guide demystifies concepts like traceability, reachability analysis, and asset lineage, pivotal for securing digital assets. Learn how ASPM empowers organizations with actionable insights for precise vulnerability management. #Cybersecurity #ASPM #ApplicationSecurity
Francesco Cipollone
Explore the transformative role of ASPM in cybersecurity. Uncover how Application Security Posture Management aligns business and security objectives for effective vulnerability management and risk reduction. Discover Phoenix Security’s innovative approach to tackling the staggering challenge of CVEs with a strategic focus on prioritization. #ASPM #Cybersecurity #VulnerabilityManagement
Francesco Cipollone
Explore the critical insights into the latest container security vulnerabilities named leaky vessels, including CVE-2024-21626, CVE-2024-23651, CVE-2024-23653, and CVE-2024-23652, BuildKit flaws, with our comprehensive guide on mitigation strategies, best practices for application security, and tips for robust vulnerability management in Docker and Kubernetes environments. Stay ahead in securing your container deployments against potential threats with ASPM help
Francesco Cipollone

Jeevan Singh

Founder of Manicode Security

Jeevan Singh is the Director of Security Engineering at Rippling, with a background spanning various Engineering and Security leadership roles over the course of his career. He’s dedicated to the integration of security practices into software development, working to create a security-aware culture within organizations and imparting security best practices to the team.
In his role, Jeevan handles a range of tasks, from architecting security solutions to collaborating with Engineering Leadership to address security vulnerabilities at scale and embed security into the fabric of the organization.

James Berthoty

Founder of Latio Tech

James Berthoty has over ten years of experience across product and security domains. He founded Latio Tech to help companies find the right security tools for their needs without vendor bias.

Christophe Parisel

Senior Cloud Security Architect

Senior Cloud Security Architect

Chris Romeo

Co-Founder
Security Journey

Chris Romeo is a leading voice and thinker in application security, threat modeling, and security champions and the CEO of Devici and General Partner at Kerr Ventures. Chris hosts the award-winning “Application Security Podcast,” “The Security Table,” and “The Threat Modeling Podcast” and is a highly rated industry speaker and trainer, featured at the RSA Conference, the AppSec Village @ DefCon, OWASP Global AppSec, ISC2 Security Congress, InfoSec World and All Day DevOps. Chris founded Security Journey, a security education company, leading to an exit in 2022. Chris was the Chief Security Advocate at Cisco, spreading security knowledge through education and champion programs. Chris has twenty-six years of security experience, holding positions across the gamut, including application security, security engineering, incident response, and various Executive roles. Chris holds the CISSP and CSSLP certifications.

Jim Manico

Founder of Manicode Security

Jim Manico is the founder of Manicode Security, where he trains software developers on secure coding and security engineering. Jim is also the founder of Brakeman Security, Inc. and an investor/advisor for Signal Sciences. He is the author of Iron-Clad Java: Building Secure Web Applications (McGraw-Hill), a frequent speaker on secure software practices, and a member of the JavaOne Rockstar speaker community. Jim is also a volunteer for and former board member of the OWASP foundation.

Join our Mailing list!

Get all the latest news, exclusive deals, and feature updates.