Log in Start free

Vulnerability · Published Mar 30, 2023 · Assigned by hackerone

CVE-2023-27534

High 8.8

In plain English

A high-severity path traversal in https://github.com/curl/curl. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)2.4%top 15.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9curl7.76.1-26.el9ALSA-2023:6679
AlmaLinux:9curl-minimal7.76.1-26.el9ALSA-2023:6679
AlmaLinux:9libcurl7.76.1-26.el9ALSA-2023:6679
AlmaLinux:9libcurl-devel7.76.1-26.el9ALSA-2023:6679
AlmaLinux:9libcurl-minimal7.76.1-26.el9ALSA-2023:6679
Alpine:v3.20curl8.0.0-r0ALPINE-CVE-2023-27534
Alpine:v3.21curl8.0.0-r0ALPINE-CVE-2023-27534
Alpine:v3.22curl8.0.0-r0ALPINE-CVE-2023-27534
Alpine:v3.23curl8.0.0-r0ALPINE-CVE-2023-27534
Alpine:v3.24curl8.0.0-r0ALPINE-CVE-2023-27534
Debian:12curl7.88.1-7DEBIAN-CVE-2023-27534
Debian:13curl7.88.1-7DEBIAN-CVE-2023-27534
Debian:14curl7.88.1-7DEBIAN-CVE-2023-27534
Ubuntu:22.04:LTScurl7.81.0-1ubuntu1.10UBUNTU-CVE-2023-27534
Ubuntu:22.04:LTScurl7.81.0-1ubuntu1.10USN-5964-1

Affected products (as reported)

VendorProductVersions
n/a https://github.com/curl/curl Fixed in 8.0.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References