Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2009-0037 — Cross-Site Request Forgery in Curl

CWE-352 — Cross-Site Request ForgeryCWE-441 — Confused DeputyCWE-918 — Server-Side Request Forgery12 documents10 sources
Severity
6.8MEDIUMNVD
EPSS
9.5%
top 7.14%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
3
Haxx CurlCurlCurl Libcurl
Timeline
PublishedMar 5
Latest updateMay 2

Description

The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3) execute arbitrary commands via a redirect to an scp: URL.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages3 packages

▶NVDcurl/libcurl16 versions+15
▶Debianhaxx/curl< 7.18.2-8.1+3
▶NVDcurl/curl64 versions+63

Patches

Patch: curl.haxx.se ↗Patch: curl.haxx.se ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-jr23-52fg-m7rm: The redirect implementation in curl and libcurl 5↗2022-05-02
▶
OSV
CVE-2009-0037: The redirect implementation in curl and libcurl 5↗2009-03-05
▶
CVEList
CVE-2009-0037: The redirect implementation in curl and libcurl 5↗2009-03-05
▶

💥Exploits & PoCs

1
Exploit-DB
cURL/libcURL 7.19.3 - HTTP 'Location:' Redirect Security Bypass↗2009-03-03
▶

📋Vendor Advisories

3
Red Hat
curl: local file access via unsafe redirects↗2009-03-03
▶
Ubuntu
curl vulnerability↗2009-03-03
▶
Debian
CVE-2009-0037: curl - The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOP...↗2009
▶

📐Framework References

2
CWE
Unintended Proxy or Intermediary ('Confused Deputy')↗
▶
CWE
Server-Side Request Forgery (SSRF)↗
▶

💬Community

2
Bugzilla
CVE-2009-3956 acroread: script injection vulnerability (APSB10-02)↗2010-01-11
▶
Bugzilla
CVE-2009-0037 curl: local file access via unsafe redirects↗2009-02-12
▶
CVE-2009-0037 — Cross-Site Request Forgery in Curl | cvebase