Usage of disabled protocol

Vulnerability

The vulnerability resides in the protocol selection parameter handling within curl and libcurl versions prior to the fix. When the --proto option is used with a parameter that disables all protocols (e.g., --proto -all,-http) without adding any, a logic error in protocol removal causes the default set of protocols to remain in the allowed set. This allows a request to be performed using a disabled protocol. Affected versions include all curl and libcurl releases before the patch that addressed this issue [4].

Exploitation

To exploit this flaw, an attacker would need to craft a command-line invocation of curl that uses the specific protocol selection syntax that disables all protocols. The attack requires local access to execute the curl command or the ability to influence command-line arguments used by a script or application invoking curl. The user or administrator would have to explicitly run a command such as curl --proto -all,-http http://curl.se. While unlikely in normal usage, it could be triggered if an attacker controls the arguments passed to curl.

Impact

Successful exploitation would result in curl using a protocol that was intended to be disabled. This could allow an attacker to bypass security restrictions that rely on protocol disabling, potentially enabling connections to untrusted servers using plaintext protocols like HTTP, which could lead to information disclosure or man-in-the-middle attacks. The curl security team assessed this as low severity due to the impracticality of the required command in real-world scenarios [4].

Mitigation

Users should update to a fixed version of curl. The fix is included in curl releases after March 27, 2024, as described in the security advisory [4]. No workarounds are necessary if the command-line is not modified by untrusted input; however, administrators should ensure that the --proto option is not used with the specific syntax that disables all protocols. The vulnerability was also addressed in Apple's macOS Sonoma 14.6, Ventura 13.6.8, and Monterey 12.7.6 updates (CVE-2024-40804, CVE-2024-40783) [1][2][3].