CVE-2016-8624 Server-side request forgery in curl
An attacker can trick curl into connecting to a different host by exploiting URL parsing flaws, bypassing domain restrictions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-8624?
CVE-2016-8624 is a medium-severity server-side request forgery vulnerability in Haxx Curl, published on 31 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them.
Weakness: CWE-20
Which versions are affected by CVE-2016-8624?
It affects 1 product.
Products include Haxx Curl.
How do I fix CVE-2016-8624?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2016-8624 being exploited?
There is no known exploitation of CVE-2016-8624 in the wild and no public exploit code.
Other vulnerabilities in Haxx Curl
Sources
Also known as ALPINE-CVE-2016-8624, CLEANSTART-2026-RX12928, CURL-CVE-2016-8624, DEBIAN-CVE-2016-8624, GHSA-6pj7-p5f2-4p6f, UBUNTU-CVE-2016-8624.