Lucene search

K
hackeroneNyymiH1:1898475
HistoryMar 09, 2023 - 6:09 p.m.

curl: CVE-2023-27538: SSH connection too eager reuse still

2023-03-0918:09:38
nyymi
hackerone.com
129

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

1.7 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:S/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

12.8%

Summary:

There’s a check if SSH keys match between new and existing connection when considering reuse. This check is broken due to wrong comparison:
#define PROTO_FAMILY_SSH (CURLPROTO_SCP|CURLPROTO_SFTP)

else if(get_protocol_family(needle->handler) == PROTO_FAMILY_SSH) {
This never matches as handler family is either CURLPROTO_SCP or CURLPROTO_SFTP.

Remediation

  • Make the code:
    else if(get_protocol_family(needle->handler) & PROTO_FAMILY_SSH) {

Steps To Reproduce:

  1. Make two connections to the same host with different ssh keys

Impact

Connection reuse when different ssh keys are used.

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

1.7 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:S/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

12.8%