cURL up to 7.x SFTP /~2/foo path traversal

Summaryinfo

A vulnerability identified as critical has been detected in cURL up to 7.x. Affected by this vulnerability is an unknown functionality of the file /~2/foo of the component SFTP. This manipulation causes path traversal. This vulnerability appears as CVE-2023-27534. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in cURL up to 7.x (Network Utility Software) and classified as critical. Affected by this vulnerability is some unknown functionality of the file /~2/foo of the component SFTP. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user.

The weakness was presented 03/31/2023. The advisory is shared at hackerone.com. This vulnerability is known as CVE-2023-27534 since 03/02/2023. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 238296 (Debian dla-4213 : curl - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 8.0.0 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (238296) and EUVD (EUVD-2023-31289). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Network Utility Software

Name

• cURL

Version

• 7.x

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion