curl Patches HTTP/2 Upload Flaw After PoC Demonstrates Client-Side Code Execution
Overview
A vulnerability in curl, specifically in its handling of HTTP/2 uploads, has been fixed following the discovery that a malicious server could exploit this flaw to corrupt a client's memory. This could potentially lead to code execution on the machine that is uploading data. The issue was reported by a researcher who demonstrated how an attacker could take control of a client, although this requires detailed knowledge of the client's build and memory layout. The curl project released a patch on October 14, 2023, in version 8.23.0. While the risk of a successful attack is considered low, the potential for a crash indicates the seriousness of the flaw, affecting users of curl who implement HTTP/2 uploads.
Key Takeaways
- Affected Systems: curl versions prior to 8.23.0
- Action Required: Update to curl version 8.
- Timeline: Disclosed on October 14, 2023
Original Article Summary
A flaw in how curl handles HTTP/2 uploads lets a malicious server receiving an upload corrupt the client's memory, and the researcher who reported it turned that into code execution on the uploading machine. The curl project fixed it on October 14 in curl 8.23.0. Taking over a client needs exact knowledge of its build and memory layout, and curl expects a real attack to end in a crash
Impact
curl versions prior to 8.23.0
Exploitation Status
No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.
Timeline
Disclosed on October 14, 2023
Remediation
Update to curl version 8.23.0 or later
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to Exploit, Vulnerability, Patch.