Vulnerability in Haxx Curl
CVE-2022-43551
A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) `.`. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.
EPSS: 0.165 (96.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Haxx Curl
- Netapp Active_iq_unified_manager
- Netapp Oncommand_insight
- Netapp Oncommand_workflow_automation
- Netapp Snapcenter
- Splunk Universal_forwarder — versions 9.1.0
- Fedoraproject Fedora — versions 37
- N/a Https://github.com/curl/curl — versions Fixed in curl 7.87.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- support@hackerone.com (Exploit, Third Party Advisory)
- support@hackerone.com (vendor-advisory, Mailing List, Third Party Advisory)
- support@hackerone.com (Third Party Advisory)
- support@hackerone.com (Third Party Advisory)
Frequently asked questions
- What is CVE-2022-43551?
- CVE-2022-43551 is a high-severity vulnerability in Haxx Curl, classified under Cleartext Transmission of Sensitive Information. CVSS score: 7.5/10. Published 2022-12-23.
- How severe is CVE-2022-43551?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2022-43551 known to be exploited?
- 8 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.