CVE-2023-23915
Plain English Summary
AI-powered analysis for quick understanding
This vulnerability allows an attacker to potentially intercept sensitive information during data transfers because the curl tool may fail to upgrade certain HTTP requests to secure HTTPS when multiple requests are made at the same time. This issue occurs only when using curl versions prior to 7.88.0 and can lead to unprotected data being sent over the internet instead of the intended secure connection.
Technical Description
A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when multiple transfers are done in parallel as the HSTS cache file gets overwritten by the most recentlycompleted transfer. A later HTTP-only transfer to the earlier host name would then *not* get upgraded properly to HSTS.
CVSS Vector Analysis
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploit Resources
Search for proof-of-concept code and exploit modules
Official References
Quick Information
Published
Feb 23, 2023
about 3 years ago
Last Modified
Feb 13, 2026
about 2 months ago
Vendor
haxx
Product
curl
Related Vulnerabilities
This vulnerability allows an attacker to potentially execute arbitrary code on a system using curl when making a second SMB request to the same host, due to the software mistakenly using memory that has already been freed. To exploit this, the attacker must be able to send multiple SMB requests to the same server, which could happen in certain network configurations.
This vulnerability allows an attacker to potentially gain access to sensitive information by reusing an existing HTTP proxy connection, even if the new request uses different login credentials. This issue occurs when the curl tool fails to establish a separate connection for requests that require different authentication, which could lead to unauthorized data exposure if an attacker can control the proxy or its traffic.
This vulnerability allows an attacker to potentially capture an OAuth2 bearer token when a user is redirected from one website to another, exposing sensitive information. This can happen if the second website has credentials stored in the user's .netrc file, which curl mistakenly sends along with the token.
This vulnerability allows an attacker to potentially access sensitive information by reusing an existing connection that was authenticated with different user credentials, leading to unauthorized actions. This can happen if an application makes multiple requests to the same server using Negotiate authentication, where the first request is authenticated with one user's credentials and the second request mistakenly uses that same connection, thinking it's authenticated with a different user's credentials.
This vulnerability allows an attacker to potentially send incorrect data during an HTTP POST request if the same connection handle was previously used for a PUT request, which could lead to unexpected application behavior. It mainly affects applications that reuse connection handles without properly resetting them, making it important for developers to be cautious when switching between different types of requests.