CVE-2024-2379: Haxx Curl Certificate Verification Bypass

CVE-2024-2379 Overview

CVE-2024-2379 is a certificate validation bypass vulnerability in libcurl that affects QUIC connections when built with wolfSSL as the TLS backend. When libcurl is configured to use an unknown or invalid cipher suite or elliptic curve, the error handling path incorrectly skips certificate verification and returns a success status. This allows connections to proceed without validating the server's TLS certificate, potentially enabling man-in-the-middle attacks against applications using affected curl builds.

Critical Impact

Applications using libcurl with wolfSSL for QUIC connections may accept invalid or malicious TLS certificates when specific cipher/curve configuration errors occur, bypassing all certificate-based security controls.

Affected Products

• Haxx curl 8.6.0
• Apple macOS (multiple versions)
• NetApp Active IQ Unified Manager
• NetApp ONTAP Select Deploy Administration Utility
• NetApp HCI Compute Node and Bootstrap OS
• NetApp H-Series Storage Systems (H300S, H410S, H500S, H610C, H610S, H615C, H700S)

Discovery Timeline

• 2024-03-27 - CVE-2024-2379 published to NVD
• 2025-07-30 - Last updated in NVD database

Technical Details for CVE-2024-2379

Vulnerability Analysis

This vulnerability (CWE-295: Improper Certificate Validation) exists in the error handling logic within libcurl's QUIC connection implementation when using wolfSSL. The flaw occurs specifically during TLS handshake initialization when an application specifies cipher suites or elliptic curves that wolfSSL does not recognize or support.

Under normal operation, libcurl performs rigorous certificate verification to ensure the authenticity of remote servers. However, when the cipher/curve configuration fails validation, the error path contains a logic flaw that causes the verification step to be bypassed entirely. Instead of properly propagating the error and aborting the connection, the function returns an OK status, allowing the connection to proceed with an unverified certificate.

This behavior fundamentally undermines TLS security for affected connections, as the entire trust model depends on proper certificate validation to prevent impersonation attacks.

Root Cause

The root cause is improper error handling in libcurl's QUIC/wolfSSL integration layer. When CURLE_SSL_CIPHER or similar errors are generated due to invalid cipher/curve configuration, the code path that handles these errors fails to maintain the certificate verification requirement. The error recovery logic incorrectly assumes the connection should continue, bypassing the certificate validation step that would normally occur.

This represents a classic case of error path divergence, where exceptional conditions lead to security-critical code being skipped. The vulnerable code path was introduced in curl 8.6.0's QUIC support enhancements.

Attack Vector

The attack requires network-level access and user interaction to exploit successfully. An attacker positioned to intercept network traffic (man-in-the-middle position) could potentially exploit this vulnerability in the following scenario:

1. The victim application uses libcurl built with wolfSSL for QUIC connections
2. The application's curl configuration specifies an unsupported or malformed cipher/curve option
3. The attacker intercepts the QUIC connection and presents a malicious certificate
4. Due to the verification bypass, curl accepts the fraudulent certificate
5. The attacker can now decrypt, inspect, and modify traffic between the client and intended server

The vulnerability requires specific build configurations (wolfSSL backend) and connection parameters (QUIC protocol with problematic cipher/curve settings) to be exploitable. The original report was submitted via HackerOne Report #2410774.

Detection Methods for CVE-2024-2379

Indicators of Compromise

• Unexpected TLS certificate warnings or errors in application logs followed by successful connections
• Network traffic analysis showing QUIC connections to known-bad or untrusted certificate authorities
• Applications built with libcurl/wolfSSL exhibiting connection behavior inconsistent with strict certificate validation
• Log entries indicating cipher or curve configuration errors during QUIC handshakes

Detection Strategies

• Audit curl build configurations to identify installations using wolfSSL as the TLS backend
• Monitor for curl/libcurl error messages containing cipher or curve-related warnings
• Implement network monitoring to detect QUIC traffic with unusual certificate chains
• Review application configurations that explicitly set cipher suites or elliptic curves for curl connections

Monitoring Recommendations

• Enable verbose logging for curl operations to capture TLS handshake details
• Implement certificate transparency log monitoring for unexpected certificates
• Deploy network sensors capable of inspecting QUIC traffic metadata
• Set up alerts for applications using known vulnerable curl versions with wolfSSL

How to Mitigate CVE-2024-2379

Immediate Actions Required

• Update curl/libcurl to a patched version that addresses the certificate verification bypass
• Review and validate cipher suite and curve configurations to ensure they use known-supported values
• Consider temporarily disabling QUIC connections in affected applications until patches are applied
• Implement certificate pinning at the application level as an additional defense layer

Patch Information

Security patches are available from multiple vendors. Refer to the CURL Security Advisory for CVE-2024-2379 for the official fix from the curl project. Apple has released patches in macOS updates documented in Apple Support Article HT214118, HT214119, and HT214120. NetApp customers should consult the NetApp Security Advisory NTAP-20240531-0001 for affected product-specific guidance.

Workarounds

• Use alternative TLS backends (OpenSSL, GnuTLS) instead of wolfSSL for QUIC connections
• Implement application-level certificate validation independent of curl's verification
• Restrict curl configurations to explicitly supported cipher suites and curves only
• Deploy network security controls to validate TLS certificates at the network layer

# Verify curl build configuration and TLS backend
curl --version | grep -i "ssl\|tls\|wolfssl\|quic"

# Check for affected version
curl --version | head -1

# Example: Rebuild curl with OpenSSL instead of wolfSSL if necessary
# ./configure --with-openssl --without-wolfssl