Lucene search

K
osvGoogleOSV:CURL-CVE-2023-23914
HistoryFeb 15, 2023 - 8:00 a.m.

HSTS ignored on multiple requests

2023-02-1508:00:00
Google
osv.dev
1
hsts
curl
https
clear-text
http
insecure
mechanism
reproducible

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

9.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.9%

curl’s HSTS functionality fail when multiple URLs are requested serially.

Using its HSTS support, curl can be instructed to use HTTPS instead of using
an insecure clear-text HTTP step even when HTTP is provided in the URL. This
HSTS mechanism would however surprisingly be ignored by subsequent transfers
when done on the same command line because the state would not be properly
carried on.

Reproducible like this:

curl --hsts "" https://curl.se http://curl.se

The first URL returns HSTS information that the second URL fails to take
advantage of.

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

9.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.9%