CVE-2024-2004: Haxx Curl DOS Vulnerability

CVE-2024-2004 Overview

CVE-2024-2004 is a protocol selection logic error vulnerability in curl. When a protocol selection parameter option disables all protocols without adding any, the default set of protocols remains in the allowed set due to a logic flaw in the protocol removal code. This could allow requests to proceed using plaintext protocols that were explicitly intended to be disabled.

Critical Impact

A logic error in curl's --proto option processing could allow unintended plaintext protocol usage when attempting to disable all protocols, potentially leading to sensitive information disclosure over insecure connections.

Affected Products

• Haxx curl (multiple versions)
• Apple macOS (multiple versions)
• Fedora Project Fedora 39 and 40
• NetApp ONTAP 9
• NetApp ONTAP Select Deploy Administration Utility
• NetApp Bootstrap OS
• NetApp HCI Compute Node
• NetApp H300S, H410S, H500S, H700S firmware and hardware

Discovery Timeline

• 2024-03-27 - CVE-2024-2004 published to NVD
• 2025-07-30 - Last updated in NVD database

Technical Details for CVE-2024-2004

Vulnerability Analysis

This vulnerability exists in curl's command-line protocol selection mechanism. When users attempt to use the --proto option to disable all available protocols (for example, using --proto -all,-http), a logic error causes the default protocol set to remain active instead of being properly cleared.

The practical impact is that a command explicitly designed to block all protocols would still permit requests to proceed. For instance, a request to curl --proto -all,-http http://curl.se would complete using the plaintext HTTP protocol despite the user's explicit attempt to disable it.

The curl security team assessed this as a low severity issue because the vulnerable configuration—disabling the entire set of available protocols—represents a command with no practical utility. This scenario is unlikely to occur in real-world applications, as there's no legitimate reason to invoke curl while disabling every supported protocol.

Root Cause

The root cause is an interpretation conflict vulnerability (CWE-436) in curl's protocol selection logic. When processing the --proto parameter, the code fails to properly handle the edge case where all protocols are removed. Instead of resulting in an empty protocol set (which would effectively disable all transfers), the logic erroneously falls back to the default protocol configuration.

This occurs because the protocol removal code checks for an empty result set and interprets it as "no changes specified" rather than "all protocols disabled," leading to the unintended behavior.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker cannot directly exploit this vulnerability remotely. Instead, exploitation would require:

1. A user or automated script intentionally configuring curl to disable all protocols
2. The same command also specifying a URL to fetch
3. The expectation that the request would fail due to no protocols being available

In this scenario, instead of failing, the request would proceed using the default plaintext protocol, potentially exposing sensitive data that the user believed was protected by protocol restrictions. The vulnerability requires authenticated access (low privileges) as curl must be invoked by a user with local system access.

Detection Methods for CVE-2024-2004

Indicators of Compromise

• Unexpected network traffic using plaintext protocols (HTTP, FTP, etc.) from systems where protocol restrictions were expected
• curl command invocations containing --proto -all or similar patterns attempting to disable all protocols
• Configuration files or scripts using curl with -all protocol modifiers combined with plaintext URLs

Detection Strategies

• Monitor curl command-line usage for --proto options that attempt to remove all protocols using the -all syntax
• Audit shell scripts and automation workflows for potentially vulnerable curl invocations
• Review network logs for plaintext HTTP/FTP traffic from systems expected to enforce protocol restrictions

Monitoring Recommendations

• Implement command-line auditing to log curl executions with --proto parameters
• Deploy network monitoring to detect plaintext protocol usage from sensitive systems
• Establish baseline network behavior to identify anomalous unencrypted traffic patterns

How to Mitigate CVE-2024-2004

Immediate Actions Required

• Update curl to the latest patched version available for your operating system
• Review scripts and automation that use curl's --proto option for potentially affected configurations
• Verify that protocol restrictions are working as intended by testing curl configurations

Patch Information

Patches are available from multiple vendors. The official curl security advisory is available at CURL CVE-2024-2004 Documentation. Additional vendor-specific patches include:

• Apple macOS: Security updates documented in Apple Support Document HT214118, HT214119, and HT214120
• Fedora: Package updates available via Fedora Package Announcement
• NetApp: Advisory available at NetApp Security Advisory NTAP-20240524-0006

Workarounds

• Instead of using --proto -all to disable protocols, explicitly specify only the protocols you want to allow using --proto =https or similar
• Use network-level controls (firewalls, proxy servers) to enforce protocol restrictions rather than relying solely on curl's --proto option
• Implement wrapper scripts that validate curl configurations before execution to catch potentially vulnerable patterns

# Recommended: Explicitly allow only specific protocols instead of trying to disable all
# Correct approach - specify allowed protocols with equals sign
curl --proto =https https://example.com

# Avoid: Using -all to disable protocols (vulnerable pattern)
# curl --proto -all,-http http://example.com  # DO NOT USE