Are Libcurl and Curl bad? Mitigation to vulnerabilities CVE-2023-38545 and CVE-2023-38546

CVE-2023-38546, CVE-2023-38545 curl in the wild, libcurl, curl, vulnerability, application security, vulnerability management


CVE-2023-38546, CVE-2023-38545 curl in the wild, libcurl, curl, vulnerability, application security, vulnerability management

The curl and libcurl project has shaken the world recently with a critical vulnerability for CVE-2023-38545 that has been mitigated by the condition that will trigger this vulnerability.

Recently we released two article on the vulnerability CVE-2023-38545 and how to fix curl vulnerability in various systems. This flaw could potentially cause a heap overflow, putting countless systems at risk. In this blog post, we’ll delve into the details of this vulnerability, its impact, and the steps taken to mitigate it.

Update on curl, Libcurl


OCTOBER 11, 2023 DANIEL STENBERG 9 COMMENTS In association with the release of curl 8.4.0, we publish a security advisory and all the details for CVE-2023-38545. This problem is the worst security problem found in curl in a long time. We set it to severity HIGH. At the same time, the advisory contains all the necessary details. I figured I would use a few additional words and expand the explanations for anyone who cares to understand how this flaw works and how it happened. Background curl has supported SOCKS5 since August 2002. SOCKS5 is a proxy protocol. It is a rather simple protocol for setting up network communication via a dedicated “middle man”. The protocol is for example, typically used when setting up communication to get done over Tor but also for accessing the Internet from within organizations and companies.


What is curl and how is it related to libcurl?

libcurl is a free and easy-to-use client-side URL transfer library, supporting a wide range of protocols like HTTP, HTTPS, FTP, and more. It is widely used in various applications and systems, making any vulnerability in libcurl a cause for concern.

The curl Vulnerability: CVE-2023-38545

Background

The vulnerability was related to libcurl’s support for the SOCKS5 proxy protocol. A local variable, socks5_resolve_local, was improperly managed, leading to a heap overflow condition. This could be exploited by an attacker who controls an HTTPS server accessed over a SOCKS5 proxy.

Complexity of the Attack

While the vulnerability is severe, exploiting it is not straightforward. The attacker needs to deliver a URL that will lead to the overflow. This makes the attack less direct compared to vulnerabilities where the remote end could trigger the overflow directly. If the flaw were in the HTTP/HTTPS protocols without the involvement of a SOCKS5 proxy, it would be considered a critical vulnerability.

This bug was introduced when the SOCKS5 handshake code was converted from a blocking function into a non-blocking state machine.

The analysis in this section is specific to curl version 8. Some older versions of curl version 7 have less restriction on hostname length and/or a smaller SOCKS negotiation buffer size that cannot be overridden by CURLOPT_BUFFERSIZE.

The options that cause SOCKS5 with remote hostname to be used in libcurl:

  • CURLOPT_PROXYTYPE set to type CURLPROXY_SOCKS5_HOSTNAME, or:
  • CURLOPT_PROXY or CURLOPT_PRE_PROXY set to use the scheme socks5h://
  • One of the proxy environment variables can be set to use the socks5h:// scheme. For example http_proxyHTTPS_PROXY or ALL_PROXY.

The urgency of the Issue for curl

The flaw was discovered through code review in approximately two hours, once the area of the code containing the flaw was identified. This highlights the urgency of releasing a fix for this vulnerability.

Analysis of the previous year’s vulnerabilities

Vulnerabilites, Curl, libcurl, application security, vulnerability management

Credit curl report

  1. Yearly Frequency: On average, you can expect about 0.26 vulnerabilities to be reported yearly. Again, the sample data might not be fully representative.
  2. Common Type of Vulnerabilities: The most common type of vulnerability is… actually not specified (None) in the majority of the records. It occurs 5 times in the truncated dataset. If we’re talking about specified types, lib is the only one mentioned.
  3. Severity of Vulnerabilities: The severity label that appears most frequently is ‘H’ (High), which occurs 3 times in the truncated dataset.
  4. Critical vulnerabilities were rare and only appeared in a few years like 2000, 2013.
  5. High vulnerabilities were more frequent around 2016.
  6. Medium vulnerabilities had a noticeable peak in 2016 and 2022.
  7. Low vulnerabilities have been on the rise, especially in recent years like 2022 and 2023.

Curl and libcurl Additional Flaw with mitigations

Interestingly, another flaw was discovered in the code, but it has no security impact. The state CONNECT_SOCKS_INIT lacks an intermediate CONNECT_SOCKS_INIT_SEND state. This leads to the whole initial packet being resent if a partial write happens, causing incorrect protocol communication towards the SOCKS5 proxy. This issue will likely be handled separately to avoid drawing attention to the area of the security flaw.

Curl and libcurl Affected Versions

libcurl is used by many applications, but not always advertised as such!

Curl and libcurl Upgrade and Mitigations

Starting in curl 8.4.0, curl no longer switches to local resolve mode if the name is too long but is instead rightfully returning an error.

Patch collection for older versions

RECOMMENDATIONS

A – Upgrade curl to version 8.4.0

B – Apply the patch to your local version

C – Do not use CURLPROXY_SOCKS5_HOSTNAME proxies with curl

D – Do not set a proxy environment variable to socks5h://

What is the exploitation data behind CVE-2023-38545 and CVE-2023-38546 In the wild?

CVSS: 10 -> 7.4 -> 4.4

CTI interest: Low 0.81

RCE Type Remote: Low probability (potential local authentication)

Availability: Yes

Status: Disclosed

EPSS Score: – not registered –

Currently, there are 2673 systems with some version of curl exposed, but considering curl is embedded in every window, mac, linux version and container used like Amazon the spread and surface could be quite vaste

CVE-2023-38546, CVE-2023-38545 curl in the wild
CVE-2023-38546, CVE-2023-38545 curl in the wild, libcurl, curl, vulnerability, application security, vulnerability management

Conclusion

The libcurl vulnerability, CVE-2023-38545, was a high-severity issue that required immediate attention. While the complexity of exploiting this vulnerability is high, the urgency of fixing it cannot be overstated. Additional flaws in the code, although not security-related, also need to be addressed in due course.

This vulnerability is embedded in a lot of packages, and system native calls (linux, mac) vendors might release this vulnerability in phases.

How Phoenix Security Can Help

attack graph phoenix security
ASPM

Phoenix Security helps organizations identify and trace which systems have vulnerabilities, understanding the relation between code and cloud. One of the significant challenges in securing applications is knowing where and how frameworks like Struts are used. ASPM tools can scan the application portfolio to identify instances of Struts, mapping out where it is deployed across the organization. This information is crucial for targeted security measures and efficient patch management. Phoenix Security’s robust Application Security Posture Management (ASPM) system is adept at not just managing, but preempting the exploitation of vulnerabilities through its automated identification system. This system prioritises critical vulnerabilities, ensuring that teams can address the most pressing threats first, optimising resource allocation and remediation efforts.

The Role of Application Security Posture Management (ASPM):

ASPM plays a vital role in managing and securing applications like those built with Apache Struts. It involves continuous assessment, monitoring, and improvement of the security posture of applications. ASPM tools can:

  1. Identify and Track Struts Components: Locate where Struts is implemented within the application infrastructure.
  2. Vulnerability Management: Detect known vulnerabilities in Struts and prioritize them for remediation.
  3. Configuration Monitoring: Ensure Struts configurations adhere to best security practices.
  4. Compliance: Check if the usage of Struts aligns with relevant cybersecurity regulations and standards.

By leveraging Phoenix Security, you not only unravel the potential threats but also take a significant stride in vulnerability management, ensuring your application security remains up to date and focuses on the key vulnerabilities.

Get in control of your Application Security posture and Vulnerability management

Previous Issues of Vulnerability Weekly



Francesco is an internationally renowned public speaker, with multiple interviews in high-profile publications (eg. Forbes), and an author of numerous books and articles, who utilises his platform to evangelize the importance of Cloud security and cutting-edge technologies on a global scale.

Discuss this blog with our community on Slack

Join our AppSec Phoenix community on Slack to discuss this blog and other news with our professional security team

From our Blog

Are never-ending critical alerts leaving you scrambling? Explore how reachability analysis identifies vulnerabilities that truly matter, saving your teams from needless patch frenzies. This session, hosted by the OWASP NYC Chapter, uncovers the latest insights in ASPM, remediation techniques, and application security best practices. Attendees learn how to streamline vulnerability management through practical examples, advanced risk scoring, and live demonstrations of container-based architectures. Expect lively discussions, real-world success stories, and expert tips on targeting only the exploitable weaknesses—rather than chasing every single alert in your backlog.
Francesco Cipollone
The cybersecurity landscape is evolving rapidly, demanding a threat-centric, risk-based approach to vulnerability management. With the U.S. favoring voluntary guidelines and Europe enforcing stricter regulations, organizations must navigate compliance while focusing on real exploitability over CVE volume. This blog delves into ASPM, cloud security, and regulatory intelligence, exploring how businesses can move beyond the traditional patch-and-pray model to address root cause vulnerabilities before they become critical risks.
Francesco Cipollone
Enhance your vulnerability management with Application Security Posture Management (ASPM) and reachability analysis. Discover how ASPM helps prioritize exploitable vulnerabilities, reduce security noise, and improve risk management. Learn about advanced techniques like code and container reachability, contextual deduplication, and Phoenix Security’s cutting-edge solutions for smarter, more effective application security.
Francesco Cipollone
The 2024 CWE Top 25 is out, and it’s no casual stroll through the vulnerability garden—especially when ransomware operators are busy planting path traversal exploits, while bug bounty hunters dig up endless injection flaws. In this blog, we examine the biggest risers, the most surprising dips, and the divergence between real-world exploit data and official CWE rankings. We’ll also reveal how AI-driven ASPM (Application Security Posture Management) and Phoenix Security’s contextual risk-based approach unite to help you focus on your most pressing threats. After all, not all flaws are created equal—some are simply more mischievous than others.
Francesco Cipollone
The 2024 CWE Top 25 list highlights the most dangerous software weaknesses. This article explores the methodology behind the list and how AI is improving threat detection. Discover how Application Security Posture Management (ASPM) and unified vulnerability management can help organizations address these critical threats.
Francesco Cipollone
Phoenix Security kicks off 2025 with recognition from Gartner Digital Markets through GetApp, solidifying its position as a leader in Application Security Posture Management (ASPM). Recognised for best customer success and support in ASPM, Phoenix Security empowers organisations with comprehensive, contextual vulnerability management and actionable cybersecurity solutions. With a user-friendly interface, robust real-time monitoring, and seamless risk prioritisation, the platform reduces alert fatigue while delivering precise remediation. As a cloud security leader, Phoenix Security continues to innovate, partnering with enterprises like LastPass and ClearBank to tackle the modern cybersecurity landscape head-on.
Francesco Cipollone
Derek

Derek Fisher

Head of product security at a global fintech

Derek Fisher – Head of product security at a global fintech. Speaker, instructor, and author in application security.

Derek is an award winning author of a children’s book series in cybersecurity as well as the author of “The Application Security Handbook.” He is a university instructor at Temple University where he teaches software development security to undergraduate and graduate students. He is a speaker on topics in the cybersecurity space and has led teams, large and small, at organizations in the healthcare and financial industries. He has built and matured information security teams as well as implemented organizational information security strategies to reduce the organizations risk.

Derek got his start in the hardware engineering space where he learned about designing circuits and building assemblies for commercial and military applications. He later pursued a computer science degree in order to advance a career in software development. This is where Derek was introduced to cybersecurity and soon caught the bug. He found a mentor to help him grow in cybersecurity and then pursued a graduate degree in the subject.

Since then Derek has worked in the product security space as an architect and leader. He has led teams to deliver more secure software in organizations from multiple industries. His focus has been to raise the security awareness of the engineering organization while maintaining a practice of secure code development, delivery, and operations.

In his role, Jeevan handles a range of tasks, from architecting security solutions to collaborating with Engineering Leadership to address security vulnerabilities at scale and embed security into the fabric of the organization.

Jeevan Singh

Jeevan Singh

Founder of Manicode Security

Jeevan Singh is the Director of Security Engineering at Rippling, with a background spanning various Engineering and Security leadership roles over the course of his career. He’s dedicated to the integration of security practices into software development, working to create a security-aware culture within organizations and imparting security best practices to the team.
In his role, Jeevan handles a range of tasks, from architecting security solutions to collaborating with Engineering Leadership to address security vulnerabilities at scale and embed security into the fabric of the organization.

James

James Berthoty

Founder of Latio Tech

James Berthoty has over ten years of experience across product and security domains. He founded Latio Tech to help companies find the right security tools for their needs without vendor bias.

christophe

Christophe Parisel

Senior Cloud Security Architect

Senior Cloud Security Architect

Chris

Chris Romeo

Co-Founder
Security Journey

Chris Romeo is a leading voice and thinker in application security, threat modeling, and security champions and the CEO of Devici and General Partner at Kerr Ventures. Chris hosts the award-winning “Application Security Podcast,” “The Security Table,” and “The Threat Modeling Podcast” and is a highly rated industry speaker and trainer, featured at the RSA Conference, the AppSec Village @ DefCon, OWASP Global AppSec, ISC2 Security Congress, InfoSec World and All Day DevOps. Chris founded Security Journey, a security education company, leading to an exit in 2022. Chris was the Chief Security Advocate at Cisco, spreading security knowledge through education and champion programs. Chris has twenty-six years of security experience, holding positions across the gamut, including application security, security engineering, incident response, and various Executive roles. Chris holds the CISSP and CSSLP certifications.

jim

Jim Manico

Founder of Manicode Security

Jim Manico is the founder of Manicode Security, where he trains software developers on secure coding and security engineering. Jim is also the founder of Brakeman Security, Inc. and an investor/advisor for Signal Sciences. He is the author of Iron-Clad Java: Building Secure Web Applications (McGraw-Hill), a frequent speaker on secure software practices, and a member of the JavaOne Rockstar speaker community. Jim is also a volunteer for and former board member of the OWASP foundation.

Join our Mailing list!

Get all the latest news, exclusive deals, and feature updates.

The IKIGAI concept
x  Powerful Protection for WordPress, from Shield Security
This Site Is Protected By
ShieldPRO