CVE-2023-23915

Vulnerability

In curl versions prior to 7.88.0, the HSTS (HTTP Strict Transport Security) cache file is overwritten by the most recently completed transfer when multiple URLs are requested in parallel. This race condition causes the HSTS cache to lose entries for earlier hosts, so subsequent HTTP-only transfers to those hosts are not upgraded to HTTPS as intended. The vulnerability affects all curl versions <7.88.0.

Exploitation

An attacker does not need special network position; the vulnerability is triggered by the normal use of parallel transfers (e.g., using curl's --parallel option or multi-interface). The attacker would need to be able to intercept or observe the plaintext HTTP traffic that should have been upgraded to HTTPS. The race window occurs when multiple transfers complete concurrently, causing the HSTS cache file to be written by the last finishing transfer, overwriting previous entries.

Impact

Successful exploitation leads to a cleartext transmission of sensitive information. A later HTTP-only transfer to a host that previously had an HSTS entry will not be upgraded to HTTPS, potentially exposing credentials, cookies, or other data in plaintext over the network. The confidentiality of the communication is compromised.

Mitigation

The vulnerability is fixed in curl version 7.88.0 and later. Users should upgrade to at least curl 7.88.0. For Gentoo Linux, the fixed version is >=net-misc/curl-8.3.0-r2 [1]. No workaround is available; upgrading is the only mitigation.