SecBoard
Zurück zur CVE-Übersicht

CVE-2022-43551

HIGH(7.5)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Risk Signal Score24/100 — NIEDRIG
  • CVSS 7.5 — Hoch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

16.6%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

7.5

Technische Schwere

Beschreibung

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) `.`. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 7.87.0
  • 8.3.0-r2
  • V1.0.3.1
  • V3.1.5

Threat-Hunting-Queries

Detect attempts to bypass HSTS by using IDN characters in hostnames that resolve to ASCII counterparts, potentially leading to insecure HTTP connections.

Sentinel/Defender KQL

DeviceNetworkEvents
| where ActionType == "ConnectionInitiated"
| where RemoteUrl has_any (".xn--", "U+3002") and RemotePort == 80
| where InitiatingProcessFileName contains "curl" or InitiatingProcessCommandLine contains "curl"

Splunk SPL

(sourcetype=network_connection OR sourcetype=process_start) (url=".xn--*" OR url="*U+3002*") (port=80) (process=*curl* OR commandline=*curl*)

Sigma

title: Curl HSTS Bypass via IDN
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects potential curl HSTS bypass attempts using IDN characters in hostnames.
author: SecBoard
date: 2023/11/20
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    EventID: 3
    Image|endswith: '\curl.exe'
    DestinationPort: 80
    DestinationHostname|contains_any:
      - '.xn--'
      - 'U+3002'
  condition: selection
fields:
  - Image
  - DestinationHostname
  - DestinationPort
tags:
  - attack.defense_evasion
  - cve.2022.43551

Elastic ES|QL

from network where process.name : "curl" and destination.port == 80 and (destination.domain : "*.xn--*" or destination.domain : "*U+3002*")

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Betroffene Produkte

  • cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
  • cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
  • cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*

Referenzen