CVE-2023-27534 Path traversal in https://github.com/curl/curl
Attackers can exploit a path traversal flaw in curl's SFTP implementation to bypass filters or execute arbitrary code via crafted paths.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-27534?
CVE-2023-27534 is a high-severity path traversal vulnerability in Fedoraproject Fedora, published on 30 Mar 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user.
Weakness: CWE-22
Which versions are affected by CVE-2023-27534?
It affects 9 products.
Linux distribution packages (6)
curl SUSE:Linux Enterprise Micro 5.1 | All versions | 7.66.0-150200.4.72.1 |
curl SUSE:Linux Enterprise Micro 5.2 | All versions | 7.66.0-150200.4.72.1 |
curl SUSE:Linux Enterprise Server 12 SP5-LTSS | All versions | 8.0.1-11.117.1 |
nghttp2 SUSE:Linux Enterprise Server 12 SP5-LTSS | All versions | 1.39.2-3.20.1 |
curl SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 8.0.1-11.117.1 |
nghttp2 SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 1.39.2-3.20.1 |
Products include Broadcom Brocade Fabric Operating System Firmware, Fedoraproject Fedora, Haxx Curl, Netapp Active Iq Unified Manager, Netapp H300s Firmware, Netapp H410s Firmware and 3 more.
How do I fix CVE-2023-27534?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-27534 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-27534 exists.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2023-27534, AZL-25784, AZL-25806, AZL-25810, AZL-25847, AZL-34607 and 15 more.