PT-2023-2319 · Curl+9 · Curl+9
Harry Sintonen
·
Publicado
2023-03-20
·
Atualizado
2026-05-18
·
CVE-2023-27534
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
curl versions prior to 8.0.0
Description
A path traversal vulnerability exists in the SFTP implementation of curl, where the tilde (~) character is wrongly replaced when used as a prefix in the first path element. This flaw can be exploited by attackers to bypass filtering or execute arbitrary code by crafting a path like
/~2/foo while accessing a server with a specific user. The vulnerability allows for the circumvention of filtering or worse.Recommendations
For versions prior to 8.0.0, consider disabling the SFTP implementation until a patch is available. As a temporary workaround, avoid using the tilde (~) character as a prefix in the first path element when accessing servers via SFTP. Restrict access to SFTP servers to minimize the risk of exploitation.
Exploit
Correção
DoS
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Astra Linux
Ibm Aix
Linuxmint
Red Hat
Red Os
Suse
Ubuntu
Curl