CVE-2023-28319
📋 TL;DR
CVE-2023-28319 is a use-after-free vulnerability in curl/libcurl versions before 8.1.0 that occurs during SSH server public key verification. When verification fails, curl frees memory containing the fingerprint hash but then includes that freed data in error messages, potentially leaking sensitive heap data. This affects any application using vulnerable curl/libcurl versions with SSH key verification enabled.
💻 Affected Systems
- curl
- libcurl
📦 What is this software?
Curl by Haxx
curl is a command-line tool and library for transferring data with URLs. It supports numerous protocols including HTTP, HTTPS, FTP, and more, making it essential for API testing, web scraping, and automated data transfers.
Learn more about Curl →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →Macos by Apple
macOS is Apple's desktop and laptop operating system powering Mac computers used by millions of professionals, developers, creative professionals, and enterprise users worldwide. Built on a Unix foundation with the Darwin kernel and modern Cocoa frameworks, macOS delivers a seamless ecosystem integr...
Learn more about Macos →⚠️ Risk & Real-World Impact
Worst Case
Sensitive heap memory contents containing passwords, keys, or other application data could be exposed in error messages visible to users or logged in clear text.
Likely Case
Limited information disclosure of heap memory fragments, potentially revealing some application state or configuration details.
If Mitigated
No data leakage if proper error handling prevents exposure of error messages or if SSH key verification is not used.
🎯 Exploit Status
Exploitation requires triggering SSH key verification failure, which can be done by connecting to a server with mismatched keys. Proof-of-concept code is available in public disclosures.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: curl 8.1.0 and later
Vendor Advisory: https://curl.se/docs/CVE-2023-28319.html
Restart Required: Yes
Instructions:
1. Download curl 8.1.0 or later from https://curl.se/download.html
2. Compile and install according to your platform instructions
3. Restart any services or applications using libcurl
4. Verify the update with 'curl --version'
🔧 Temporary Workarounds
Disable SSH key hash verification
allAvoid using CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and related options for SSH key verification
# Modify application code to remove CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 usage
Use alternative SSH verification methods
allUse known_hosts file verification instead of hash-based verification
# Configure curl to use known_hosts file: curl_easy_setopt(curl, CURLOPT_SSH_KNOWNHOSTS, "/path/to/known_hosts")
🧯 If You Can't Patch
- Disable SSH connections entirely in affected applications
- Implement network segmentation to restrict SSH connections to trusted servers only
🔍 How to Verify
Check if Vulnerable:
Run 'curl --version' and check if version is below 8.1.0. Also check if application code uses SSH key hash verification options.Check Version:
curl --version | head -1Verify Fix Applied:
Confirm curl version is 8.1.0 or higher with 'curl --version'. Test SSH connections with key verification to ensure no memory errors occur.📡 Detection & Monitoring
Log Indicators:
- Error messages containing unusual hex strings or memory addresses after SSH connection failures
- Application crashes or memory corruption errors during SSH operations
Network Indicators:
- Failed SSH connections with curl/libcurl user agents
- Unusual SSH connection patterns to trigger verification failures
SIEM Query:
source="application.logs" AND "curl" AND "SSH" AND ("verification failed" OR "fingerprint")🔗 References
- http://seclists.org/fulldisclosure/2023/Jul/47
- http://seclists.org/fulldisclosure/2023/Jul/48
- http://seclists.org/fulldisclosure/2023/Jul/52
- https://hackerone.com/reports/1913733
- https://security.gentoo.org/glsa/202310-12
- https://security.netapp.com/advisory/ntap-20230609-0009/
- https://support.apple.com/kb/HT213843
- https://support.apple.com/kb/HT213844
- https://support.apple.com/kb/HT213845
- http://seclists.org/fulldisclosure/2023/Jul/47
- http://seclists.org/fulldisclosure/2023/Jul/48
- http://seclists.org/fulldisclosure/2023/Jul/52
- https://hackerone.com/reports/1913733
- https://security.gentoo.org/glsa/202310-12
- https://security.netapp.com/advisory/ntap-20230609-0009/
- https://support.apple.com/kb/HT213843
- https://support.apple.com/kb/HT213844
- https://support.apple.com/kb/HT213845
