CVE-2023-27534: Haxx Curl Path Traversal Vulnerability

CVE-2023-27534 Overview

A path traversal vulnerability exists in curl versions prior to 8.0.0 within the SFTP implementation. The vulnerability causes the tilde (~) character to be incorrectly replaced when used as a prefix in the first path element, beyond its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering mechanisms or potentially execute arbitrary code by crafting malicious paths such as /~2/foo while accessing a server with a specific user.

Critical Impact
This path traversal flaw enables attackers to access files outside the intended directory structure on SFTP servers, potentially leading to unauthorized data access, information disclosure, or code execution in vulnerable curl deployments.

Affected Products

Haxx curl (versions prior to 8.0.0)
Fedora Project Fedora 36
NetApp Active IQ Unified Manager (VMware vSphere)
Broadcom Brocade Fabric Operating System Firmware
NetApp H300S, H500S, H700S, H410S Series Firmware
Splunk Universal Forwarder (multiple versions including 9.1.0)

Discovery Timeline

2023-03-30 - CVE-2023-27534 published to NVD
2025-04-23 - Last updated in NVD database

Technical Details for CVE-2023-27534

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal), affecting curl's SFTP protocol handler. The core issue lies in how curl processes the tilde character in SFTP paths. In Unix-like systems, the tilde is conventionally used to represent a user's home directory (e.g., ~/documents expands to /home/username/documents). However, the curl SFTP implementation incorrectly processes tilde characters that appear as prefixes in non-first path elements.

When an attacker crafts a path containing patterns like /~2/foo, the SFTP handler improperly expands the tilde, allowing navigation outside the expected directory hierarchy. This behavior can be exploited to bypass path-based security filters that don't account for this parsing anomaly, potentially granting access to sensitive files or directories that should be protected.

Root Cause

The root cause stems from improper input validation in curl's SFTP path parsing logic. The code fails to restrict tilde expansion to only the first path element, where it legitimately represents the home directory shortcut. Instead, the parser incorrectly applies tilde replacement logic to tilde-prefixed elements elsewhere in the path string, creating an exploitable path traversal condition.

Attack Vector

The attack vector is network-based and requires low privileges with no user interaction needed. An attacker with the ability to influence SFTP URLs processed by a vulnerable curl client can craft malicious paths to:

Bypass Access Controls: Security filters checking for path traversal sequences (like ../) may not detect the tilde-based traversal technique
Access Arbitrary Files: Navigate to directories outside the intended scope on the SFTP server
Potential Code Execution: In certain configurations where uploaded files can be executed, this could lead to arbitrary code execution

The attack requires the attacker to have some level of authenticated access to the target SFTP server, but can bypass directory restrictions imposed by the application layer.

Detection Methods for CVE-2023-27534

Indicators of Compromise

Unusual SFTP connection patterns with path elements containing tilde prefixes in non-standard positions (e.g., /~2/, /~user/ in middle path segments)
Log entries showing access to directories outside expected user home directories via SFTP
Failed authentication or authorization events following suspicious path access attempts
Network traffic containing malformed SFTP path requests with multiple tilde characters

Detection Strategies

Monitor SFTP server logs for path patterns containing tilde characters in unexpected positions within the path string
Implement network-based detection rules to identify SFTP requests with suspicious path traversal patterns including /~[0-9]/ or /~[a-z]+/ in non-first path elements
Deploy application-layer inspection to detect curl user-agent strings accessing SFTP resources with malformed paths
Configure SentinelOne agents to detect curl processes initiating suspicious SFTP connections

Monitoring Recommendations

Enable verbose logging on SFTP servers to capture full path requests for forensic analysis
Implement real-time alerting for path traversal attempt patterns in SFTP traffic
Monitor curl version deployments across infrastructure and flag systems running versions below 8.0.0
Use SentinelOne's behavioral AI to detect anomalous file access patterns following SFTP connections

How to Mitigate CVE-2023-27534

Immediate Actions Required

Upgrade curl to version 8.0.0 or later immediately on all affected systems
Audit systems for vulnerable curl versions using package management tools and vulnerability scanners
Review SFTP server configurations to implement additional path validation at the server level
Temporarily disable SFTP functionality in curl if immediate patching is not possible

Patch Information

The vulnerability was addressed in curl version 8.0.0. Organizations should upgrade to this version or later. Vendor-specific patches are available from multiple sources:

HackerOne Report #1892351 - Original vulnerability report
Debian LTS Announcement - Debian security updates
Fedora Package Announcement - Fedora package updates
Gentoo GLSA 202310-12 - Gentoo Linux security advisory
NetApp Security Advisory ntap-20230420-0012 - NetApp product updates

Workarounds

Implement server-side path validation that explicitly blocks tilde characters in path positions other than the first element
Use application-level URL filtering to sanitize SFTP paths before passing them to curl
Deploy network segmentation to limit SFTP access to trusted systems only
Configure web application firewalls or proxy servers to inspect and block suspicious SFTP URL patterns

bash

# Verify curl version and upgrade if necessary
curl --version

# On Debian/Ubuntu systems
sudo apt update && sudo apt upgrade curl

# On RHEL/CentOS/Fedora systems
sudo dnf update curl

# On macOS with Homebrew
brew upgrade curl