CVE-2023-46219: Haxx Curl Information Disclosure Flaw

CVE-2023-46219 Overview

CVE-2023-46219 is a vulnerability in curl that affects HTTP Strict Transport Security (HSTS) data persistence. When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use. This effectively bypasses HSTS protections that are designed to ensure connections are made over HTTPS.

Critical Impact
This vulnerability can cause curl to lose HSTS enforcement data, potentially allowing downgrade attacks where secure HTTPS connections are inadvertently made over insecure HTTP, exposing sensitive data to interception.

Affected Products

Haxx curl (multiple versions)
Fedora 38
Systems using curl with HSTS caching enabled

Discovery Timeline

2023-12-12 - CVE-2023-46219 published to NVD
2025-12-02 - Last updated in NVD database

Technical Details for CVE-2023-46219

Vulnerability Analysis

The vulnerability is classified under CWE-311 (Missing Encryption of Sensitive Data), though the core issue relates to improper file handling during HSTS data persistence. When curl attempts to save HSTS cache data to a file path that exceeds system limits, the file handling logic fails in a way that results in the existing HSTS data being cleared rather than preserved.

HSTS is a critical security mechanism that instructs browsers and HTTP clients to only communicate with servers over HTTPS. By maintaining a cache of domains that have declared HSTS policies, curl ensures subsequent requests to those domains use encrypted connections. When this cache is inadvertently cleared, the client loses knowledge of these policies, potentially connecting over unencrypted HTTP to hosts that explicitly required HTTPS.

Root Cause

The root cause lies in curl's file handling logic when persisting HSTS data to disk. When the target file path exceeds certain length limitations, the save operation encounters an error condition that is not properly handled. Instead of preserving the existing file contents or failing gracefully, the operation results in truncating or removing the file contents entirely. This leaves an empty or corrupted HSTS cache file.

Attack Vector

An attacker could potentially exploit this vulnerability through several scenarios:

Indirect File Path Manipulation: If an attacker can influence the HSTS cache file path (e.g., through environment variables or configuration files), they could craft an excessively long path to trigger the vulnerability.
Man-in-the-Middle Downgrade: Once HSTS data is lost, an attacker positioned on the network path could intercept and downgrade HTTPS connections to HTTP for domains that previously had HSTS protections, enabling traffic interception.
Automated Systems: Build systems, CI/CD pipelines, or automated scripts using curl with HSTS caching could be affected if file paths are dynamically generated and become excessively long.

The vulnerability is exploited over the network, requires no special privileges, and does not require user interaction. The primary impact is on the integrity of security configurations rather than direct data exposure.

Detection Methods for CVE-2023-46219

Indicators of Compromise

Unexpectedly empty or truncated HSTS cache files used by curl
Curl processes attempting to write to file paths exceeding system path length limits
Unexpected HTTP (non-HTTPS) connections to domains that should enforce HSTS
File system errors or warnings related to HSTS file operations in application logs

Detection Strategies

Monitor for HTTP connections to domains known to require HTTPS, which may indicate HSTS cache corruption
Implement file integrity monitoring on curl HSTS cache files to detect unexpected modifications or truncations
Review application logs for file path length errors or HSTS-related warnings
Audit systems using curl to identify configurations with potentially problematic HSTS cache file paths

Monitoring Recommendations

Enable verbose logging for curl operations in critical systems to capture HSTS file handling events
Set up alerts for HTTP connections to security-sensitive endpoints that should be HTTPS-only
Periodically validate HSTS cache file integrity and contents in automated systems
Monitor network traffic for protocol downgrade patterns that could indicate HSTS bypass

How to Mitigate CVE-2023-46219

Immediate Actions Required

Update curl to the latest patched version that addresses CVE-2023-46219
Review and audit HSTS cache file paths in all curl configurations to ensure they are within safe length limits
Verify HSTS cache file contents after updating to confirm integrity
Consider implementing additional transport security measures as defense-in-depth

Patch Information

The curl project has released patches addressing this vulnerability. Detailed information is available in the official curl CVE-2023-46219 documentation. Additional security advisories have been published by:

Organizations should apply vendor-specific patches according to their distribution's update mechanisms.

Workarounds

Ensure HSTS cache file paths are kept to reasonable lengths, well within operating system limits
Use absolute paths with minimal directory depth for HSTS cache files
Implement application-level HSTS enforcement as a backup to curl's built-in caching
Consider disabling HSTS file caching if not required, using in-memory caching instead
Monitor and validate HSTS cache file integrity through periodic automated checks

bash

# Verify curl version includes the security fix
curl --version

# Check current HSTS cache file path length and contents
ls -la ~/.curl-hsts

# Update curl on Debian/Ubuntu systems
sudo apt update && sudo apt upgrade curl

# Update curl on Fedora systems
sudo dnf update curl