Secure Cloud Analytics Alerts and Observations Reference Guide
Mentions the CVE; no further detail.
CVE-2023-38545 Public exploit High · 8.8 EPSS 78.7%
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake
curl · curl
Summary
The flaw is a heap-based buffer overflow in curl's SOCKS5 proxy handshake code, where a local variable controlling whether the proxy resolves the host name can take the wrong value during a slow handshake, causing an overlong host name to be copied into a heap buffer instead of only the resolved address. An attacker who can supply or influence the host name in a URL that curl is asked to fetch through a SOCKS5 proxy can trigger the overflow, which requires the victim (user interaction) to have curl operate on that URL and a SOCKS5 proxy with host-name resolution to be in use.
Official description · CVE.org
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due to this bug, the local variable that means "let the host resolve the name" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target buffer instead of copying just the resolved address there. The target buffer being a heap based buffer, and the host name coming from the URL that curl has been told to operate with.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
37.0 / 100
- Exploited
- Not confirmed
- Reports
- 1
- Tactics
- 1/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Public exploit code (PoC-in-GitHub) was available 7 days before disclosure.
- Public exploit codePoC-in-GitHub7 days before
- Disclosedday 0
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
1 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order, 2 cited passages 1ExecutionTA0002
Exploitation for Client Execution T1203 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
AI mapping from the description · primary impact
Overflow executes when curl processes attacker URL
The target buffer being a heap based buffer, and the host name coming from the
Lower-confidence links (1)
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
- Exploit Public-Facing ApplicationT1190 needs user interaction; not a public-facing exploit
Detection
0 rules for this CVE · 35 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2023-38545 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Exploitation for Client ExecutionT120335 general rules
- Antivirus - Exploitation Framework Signaturecriticalstable
- Droppers Exploiting CVE-2017-11882criticalstable
- Audit CVE Eventcriticaltest
- CVE-2021-31979 CVE-2021-33771 Exploitscriticaltest
- CVE-2021-31979 CVE-2021-33771 Exploits by Sourgumcriticaltest
- Exploit for CVE-2017-8759criticaltest
- Antivirus - APT Malware Signaturecriticalexperimental
- Antivirus - Remote Access Tools Signaturecriticalexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Named in 1 threat report1 reportCisco
Reports are matched by finding the exact id CVE-2023-38545 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Also mentioned in 7 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Russian Hackers Manipulate NPM to Distribute Malicious Packages20 Apr 2025
- ACTUALIZACION IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Operator package issues15 Apr 2024
- ACTUALIZACION | Oracle Critical Patch Update Advisory - January 20245 Feb 2024
- ACTUALIZACION | Long Term Support Channel Update for ChromeOS14 Nov 2023
- ACTUALIZACION | IBM Automation Decision Services | 31-10-202331 Oct 2023
- ACTUALIZACION | Oracle Critical Patch Update Advisory - October 202320 Oct 2023
- 1 more on OTX