CVE-2023-38545

CRITICAL

curl - Buffer Overflow

Title source: llm

Description

This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due to this bug, the local variable that means "let the host resolve the name" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target buffer instead of copying just the resolved address there. The target buffer being a heap based buffer, and the host name coming from the URL that curl has been told to operate with.

Exploits (10)

nomisec WORKING POC 22 stars
by d0rb · poc
https://github.com/d0rb/CVE-2023-38545
nomisec SUSPICIOUS 19 stars
by UTsweetyfish · poc
https://github.com/UTsweetyfish/CVE-2023-38545
nomisec WORKING POC 8 stars
by imfht · poc
https://github.com/imfht/CVE-2023-38545
nomisec WORKING POC 6 stars
by fatmo666 · poc
https://github.com/fatmo666/CVE-2023-38545-libcurl-SOCKS5-heap-buffer-overflow
nomisec WORKING POC 4 stars
by vanigori · poc
https://github.com/vanigori/CVE-2023-38545-sample
nomisec WORKING POC 3 stars
by bcdannyboy · poc
https://github.com/bcdannyboy/CVE-2023-38545
nomisec WORKING POC 2 stars
by dbrugman · poc
https://github.com/dbrugman/CVE-2023-38545-POC
gitlab WORKING POC
by khadijaoussakel · poc
https://gitlab.com/khadijaoussakel/cve-2023-38545
nomisec WORKING POC
by nphuang · poc
https://github.com/nphuang/NS-Project-2024-Spring
nomisec WORKING POC
by Yang-Shun-Yu · poc
https://github.com/Yang-Shun-Yu/CVE-2023-38545

Scores

CVSS v3 9.8
EPSS 0.2675
EPSS Percentile 96.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (13)
fedoraproject/fedora 37
haxx/libcurl 7.69.0 - 8.4.0
microsoft/windows_10_1809 < 10.0.17763.5122
microsoft/windows_10_21h2 < 10.0.19044.3693
microsoft/windows_10_22h2 < 10.0.19045.3693
microsoft/windows_11_21h2 < 10.0.22000.2600
microsoft/windows_11_22h2 < 10.0.22621.2715
microsoft/windows_11_23h2 < 10.0.22631.2715
microsoft/windows_server_2019 < 10.0.17763.5122
microsoft/windows_server_2022 < 10.0.20348.2113
... and 3 more
Published Oct 18, 2023
Tracked Since Feb 18, 2026