CVE-2023-38545: cURL SOCKS5 Flaw Causes Heap Buffer Overflow
Summary
CVE-2023-38545 affects libcurl 7.69.0–8.3.0 and can cause a heap buffer overflow during a SOCKS5 handshake. Upgrade to 8.4.0 or avoid the affected SOCKS5 hostname proxy settings.
Key points
- The flaw occurs when libcurl uses a SOCKS5 proxy and a slow handshake causes an excessively long hostname to be copied into a buffer.
- Affected versions are libcurl 7.69.0 through 8.3.0; cURL 8.4.0 includes the fix.
- Exploitation requires an application using libcurl with a SOCKS5 proxy to make a request to a malicious URL.
- The article says denial of service may be possible, but that no remote-code-execution exploit was known at the time of its assessment.
- The article assessed the likelihood of exploitation in the wild as relatively low at that time.
- Recommended mitigation is to upgrade to 8.4.0 or later; alternatives include avoiding CURLPROXY_SOCKS5_HOSTNAME and socks5h:// proxy settings.
- For Windows instances, the article recommends waiting for an official Microsoft patch rather than manually patching cURL.
Article Details
- Vulnerability Types
- Heap-based buffer overflow in the SOCKS5 proxy handshake
- Severity
- High
- Affected Versions
- libcurl 7.69.0 to 8.3.0
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Do not use CURLPROXY_SOCKS5_HOSTNAME proxies with curl.
- Do not set a proxy environment variable to socks5h://.
CVE
People
Products
curlThe cURL team published version 8.4.0 on October 11, 2023, after announcing that it includes a fix for a high severity vulnerability assigned CVE-2023-38545.libcurlTo be susceptible to this vulnerability, an application must be using libcurl with a socks5 proxy and make a request to a malicious URL (such as in a webhook scenario).