CVE-2016-0755

What it actually does

The ConnectionExists function in lib/url.c fails to properly isolate or invalidate NTLM-authenticated proxy connections, permitting subsequent requests to inherit and reuse another user's proxy credentials.

Why it matters to the business

Organizations relying on libcurl for outbound connections through NTLM proxies face risk of credential leakage or unauthorized proxy access, potentially exposing internal resources or enabling lateral movement without direct user interaction.

How an attack unfolds

An attacker positioned to observe or influence requests through an NTLM-authenticated proxy sends crafted HTTP requests that trigger the flawed connection-reuse logic, causing libcurl to present cached NTLM credentials belonging to a different user and thereby authenticating as that user to the proxy or target.

How to fix it

Upgrade libcurl to version 7.47.0 or later on all affected systems; rebuild and redeploy any statically linked applications; where immediate upgrade is impossible, disable NTLM proxy authentication or enforce connection-per-user isolation at the application layer.

How to confirm the fix worked

Verify installed libcurl version is 7.47.0 or newer via curl-config or package manager; perform regression tests that exercise NTLM proxy connections under concurrent user sessions and confirm each session receives distinct authentication tokens.

Typical attack path

1. Identify services or applications using vulnerable libcurl versions for proxy requests
2. Configure or compromise an NTLM-authenticated HTTP proxy path
3. Issue repeated requests that exercise the ConnectionExists path with varying user contexts
4. Observe or capture successful proxy authentication using another user's NTLM tokens
5. Leverage the stolen context to access protected resources or perform actions on behalf of the victim user

How to detect it

Examine application and proxy logs for repeated NTLM authentication attempts from the same client that succeed with credentials not matching the originating user; look for curl processes establishing long-lived connections that cross user boundaries.

What your security team should do

• Prioritize patching all instances of libcurl and dependent packages across the environment
• Scan source code and binaries for static linking of vulnerable curl versions
• Review proxy logs for anomalous NTLM authentication patterns from the same client IP or process
• Implement network segmentation or additional authentication controls around proxy usage until patches are applied