CVE-2009-0037 Server-side request forgery in n/a
Remote attackers can exploit curl's redirect handling to access intranet servers, read/write local files, or execute commands via malicious URLs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-0037?
CVE-2009-0037 is a medium-severity server-side request forgery vulnerability in n/a, published on 5 Mar 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3) execute arbitrary commands via a redirect to an scp: URL.
Weakness: CWE-352
Which versions are affected by CVE-2009-0037?
It affects 2 products.
Linux distribution packages (40)
curl Red Hat:enterprise_linux:2.1::as | All versions | 0:7.8-3.rhel2 |
curl-devel Red Hat:enterprise_linux:2.1::as | All versions | 0:7.8-3.rhel2 |
curl Red Hat:enterprise_linux:2.1::aw | All versions | 0:7.8-3.rhel2 |
curl-devel Red Hat:enterprise_linux:2.1::aw | All versions | 0:7.8-3.rhel2 |
curl Red Hat:enterprise_linux:2.1::es | All versions | 0:7.8-3.rhel2 |
curl-devel Red Hat:enterprise_linux:2.1::es | All versions | 0:7.8-3.rhel2 |
curl Red Hat:enterprise_linux:2.1::ws | All versions | 0:7.8-3.rhel2 |
curl-devel Red Hat:enterprise_linux:2.1::ws | All versions | 0:7.8-3.rhel2 |
curl Red Hat:enterprise_linux:3::as | All versions | 0:7.10.6-9.rhel3 |
curl-debuginfo Red Hat:enterprise_linux:3::as | All versions | 0:7.10.6-9.rhel3 |
curl-devel Red Hat:enterprise_linux:3::as | All versions | 0:7.10.6-9.rhel3 |
curl Red Hat:enterprise_linux:3::desktop | All versions | 0:7.10.6-9.rhel3 |
curl-debuginfo Red Hat:enterprise_linux:3::desktop | All versions | 0:7.10.6-9.rhel3 |
curl-devel Red Hat:enterprise_linux:3::desktop | All versions | 0:7.10.6-9.rhel3 |
curl Red Hat:enterprise_linux:3::es | All versions | 0:7.10.6-9.rhel3 |
curl-debuginfo Red Hat:enterprise_linux:3::es | All versions | 0:7.10.6-9.rhel3 |
curl-devel Red Hat:enterprise_linux:3::es | All versions | 0:7.10.6-9.rhel3 |
curl Red Hat:enterprise_linux:3::ws | All versions | 0:7.10.6-9.rhel3 |
curl-debuginfo Red Hat:enterprise_linux:3::ws | All versions | 0:7.10.6-9.rhel3 |
curl-devel Red Hat:enterprise_linux:3::ws | All versions | 0:7.10.6-9.rhel3 |
curl Red Hat:enterprise_linux:4::as | All versions | 0:7.12.1-11.1.el4_7.1 |
curl-debuginfo Red Hat:enterprise_linux:4::as | All versions | 0:7.12.1-11.1.el4_7.1 |
curl-devel Red Hat:enterprise_linux:4::as | All versions | 0:7.12.1-11.1.el4_7.1 |
curl Red Hat:enterprise_linux:4::desktop | All versions | 0:7.12.1-11.1.el4_7.1 |
curl-debuginfo Red Hat:enterprise_linux:4::desktop | All versions | 0:7.12.1-11.1.el4_7.1 |
curl-devel Red Hat:enterprise_linux:4::desktop | All versions | 0:7.12.1-11.1.el4_7.1 |
curl Red Hat:enterprise_linux:4::es | All versions | 0:7.12.1-11.1.el4_7.1 |
curl-debuginfo Red Hat:enterprise_linux:4::es | All versions | 0:7.12.1-11.1.el4_7.1 |
curl-devel Red Hat:enterprise_linux:4::es | All versions | 0:7.12.1-11.1.el4_7.1 |
curl Red Hat:enterprise_linux:4::ws | All versions | 0:7.12.1-11.1.el4_7.1 |
curl-debuginfo Red Hat:enterprise_linux:4::ws | All versions | 0:7.12.1-11.1.el4_7.1 |
curl-devel Red Hat:enterprise_linux:4::ws | All versions | 0:7.12.1-11.1.el4_7.1 |
curl Red Hat:enterprise_linux:5::client | All versions | 0:7.15.5-2.1.el5_3.4 |
curl-debuginfo Red Hat:enterprise_linux:5::client | All versions | 0:7.15.5-2.1.el5_3.4 |
curl Red Hat:enterprise_linux:5::client_workstation | All versions | 0:7.15.5-2.1.el5_3.4 |
curl-debuginfo Red Hat:enterprise_linux:5::client_workstation | All versions | 0:7.15.5-2.1.el5_3.4 |
curl-devel Red Hat:enterprise_linux:5::client_workstation | All versions | 0:7.15.5-2.1.el5_3.4 |
curl Red Hat:enterprise_linux:5::server | All versions | 0:7.15.5-2.1.el5_3.4 |
curl-debuginfo Red Hat:enterprise_linux:5::server | All versions | 0:7.15.5-2.1.el5_3.4 |
curl-devel Red Hat:enterprise_linux:5::server | All versions | 0:7.15.5-2.1.el5_3.4 |
Products include Curl Curl, Curl Libcurl.
How do I fix CVE-2009-0037?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2009-0037 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-0037 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as CURL-CVE-2009-0037, DEBIAN-CVE-2009-0037, DSA-1738-1, GHSA-jr23-52fg-m7rm, RHSA-2009:0341.