CVE-2023-38545

CRITICAL

curl - Buffer Overflow

Title source: llm

Description

This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due to this bug, the local variable that means "let the host resolve the name" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target buffer instead of copying just the resolved address there. The target buffer being a heap based buffer, and the host name coming from the URL that curl has been told to operate with.

Exploits (10)

nomisec WORKING POC 22 stars
by d0rb · poc
https://github.com/d0rb/CVE-2023-38545
nomisec SUSPICIOUS 19 stars
by UTsweetyfish · poc
https://github.com/UTsweetyfish/CVE-2023-38545
nomisec WORKING POC 8 stars
by imfht · poc
https://github.com/imfht/CVE-2023-38545
nomisec WORKING POC 6 stars
by fatmo666 · poc
https://github.com/fatmo666/CVE-2023-38545-libcurl-SOCKS5-heap-buffer-overflow
nomisec WORKING POC 4 stars
by vanigori · poc
https://github.com/vanigori/CVE-2023-38545-sample
nomisec WORKING POC 3 stars
by bcdannyboy · poc
https://github.com/bcdannyboy/CVE-2023-38545
nomisec WORKING POC 2 stars
by dbrugman · poc
https://github.com/dbrugman/CVE-2023-38545-POC
gitlab WORKING POC
by khadijaoussakel · poc
https://gitlab.com/khadijaoussakel/cve-2023-38545
nomisec WORKING POC
by nphuang · poc
https://github.com/nphuang/NS-Project-2024-Spring
nomisec WORKING POC
by Yang-Shun-Yu · poc
https://github.com/Yang-Shun-Yu/CVE-2023-38545

Scores

CVSS v3 9.8
EPSS 0.2625
EPSS Percentile 96.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-787
Status published

Affected Products (14)

haxx/libcurl < 8.4.0
fedoraproject/fedora
netapp/active_iq_unified_manager
netapp/active_iq_unified_manager
netapp/oncommand_insight
netapp/oncommand_workflow_automation
microsoft/windows_10_1809 < 10.0.17763.5122
microsoft/windows_10_21h2 < 10.0.19044.3693
microsoft/windows_10_22h2 < 10.0.19045.3693
microsoft/windows_11_21h2 < 10.0.22000.2600
microsoft/windows_11_22h2 < 10.0.22621.2715
microsoft/windows_11_23h2 < 10.0.22631.2715
microsoft/windows_server_2019 < 10.0.17763.5122
microsoft/windows_server_2022 < 10.0.20348.2113

Timeline

Published Oct 18, 2023
Tracked Since Feb 18, 2026