Threat Trends
4 mins
In October 2023, security researchers disclosed two vulnerabilities associated with cURL and libcurl, creating a stir in the cybersecurity community. The flaws were hyped up by the security community as potentially devastating, affecting millions of devices and applications that use cURL for data transfers. However, once Project curl Security Advisory released the details, it became clear that the concerns could have been more robust, and the vulnerabilities were less severe than initially portrayed.
Let’s dissect and examine what cURL is, the CVEs that were overhyped, and what we can learn from the CVE’s release and the aftermath.
Understanding cURL: A Versatile Command-Line Data Transfer Tool
cURL is a command-line tool and library (libcurl) widely used for transferring data with protocols such as HTTP, FTP, and SMTP. It has become an indispensable tool for developers, testers, and even systems administrators for tasks ranging from API testing to web scraping. Furthermore, libcurl offers the versatility of integrating various programming languages like Python, PHP, and C++.
cURL isn't merely a command-line tool for transferring data; it's a multi-faceted utility that has found its place in many applications and workflows. Its presence reaches multiple lines of work, as well as security researchers. Even the security researchers at Hadrian Security use cURL.
cURL's Versatile Presence
Not to mention that cURL is ubiquitous and is found almost everywhere—from tiny IoT devices to large data centers. The software is a part of many operating systems and is embedded into numerous applications. Even though it isn’t always credited, the scale of its usage is immense. If you’ve used the internet, you’ve likely used a service that employs cURL in some form.
Software Supply Chain Vulnerabilities:
Supply chain attacks have been gaining traction in the cybersecurity realm. They target less-secure elements in the development and production environment to compromise the more significant whole.
In the case of cURL, its widespread use makes it a tempting target. If a threat actor can inject malicious code into cURL, they potentially compromise any applications that leverage cURL for data transfers. Thus, vulnerabilities in cURL are not just issues for cURL itself but could also affect many other services and applications that are part of this supply chain.
What Led to the Hype
Before the release of the CVE details, there was considerable buzz in the cybersecurity community. Speculation was rampant, and discussions around potential ramifications were in overdrive. The talk and rumors driven by the infosec community were fueled by the fact that cURL is used pervasively by developers, sparking concerns over the breadth of impact.
Demystifying the Hype
The vulnerabilities were inflated to appear like looming catastrophes, overshadowing what the flaws were. Headlines described these as “significant” and “high-risk,” building tension and concern in various tech communities. The general anxiety around supply chain attacks may have exacerbated the hype.
Built-Up to be the Following Significant Vulnerability
The vulnerabilities were projected as game-changers, requiring immediate and widespread mitigation action. The security community discussed the two CVEs in various forums, and some even speculated they could be as impactful as Heartbleed or Shellshock. The Project curl Security Advisory built anticipation with ample warnings about these vulnerabilities that were sounded well before their release date, furthering the suspense, which was only perpetrated by the rumors of the infosec community.
TwoCVE Details and Technical Analysis
CVE-2023-38545
This high-severity issue could cause a heap-based buffer overflow during a SOCKS5 proxy handshake. Specific conditions, such as a slow SOCKS5 handshake and an overly long hostname, had to be met for exploitation. Affected versions ranged from libcurl 7.69.0 to 8.3.0.
CVE-2023-38546
The CVE was tagged as low severity; this flaw allowed for cookie injection if specific conditions were met, including particular behaviors surrounding duplicated ‘easy handles.’ Affected versions were libcurl 7.9.1 to 8.3.0.
Great Expectations, Underwhelming Reality
Upon release, it became clear that both vulnerabilities could only be exploited under specific scenarios. While not entirely benign, their exploitation was far more constrained than initial conversations suggested.
“The cURL issue was marked with severity HIGH. This makes sense because it definitely wasn't critical. Exploitability was only possible in particular edge cases, something that would be very unlikely to be exploited from the outside and, more often than not, would require an attacker to have access to the machine already.”
Olivier Beg - Head of Hacking
Despite the letdown, these episodes underscore the importance of not only staying updated but also understanding the technical nuances behind each CVE. For the future, it’s essential to:
- Keep your software up-to-date to protect against known vulnerabilities.
- Foster a culture of critical evaluation, especially for widely-used software that sits deep within supply chains.
- Avoid sensationalism that leads to cybersecurity fatigue.
- Encourage open dialogue and technical assessments that offer a balanced view.
The hype around these CVEs offers a lesson in tempered caution. While cURL is undoubtedly a critical component of many software systems, its vulnerabilities are not necessarily catastrophic. By staying informed and vigilant, we can avoid falling prey to exaggerated claims and focus on what matters: securing our systems and applications against real threats.
