CVE-2023-38546

What it actually does

The flaw causes libcurl to store the literal string 'none' as a cookie jar filename when duplicating an easy handle that had cookies enabled but no explicit cookie file set, leading to subsequent transfers inadvertently reading cookies from a file named 'none' in the current working directory if it exists and matches the expected format.

Why it matters to the business

Applications relying on affected libcurl versions risk unauthorized cookie injection during HTTP transfers, which can undermine session integrity or expose sensitive data in networked operations across many dependent systems.

How an attack unfolds

An attacker places a crafted cookie file named 'none' in the working directory of a target process using libcurl. The victim application then creates an easy handle, enables cookies, duplicates it via curl_easy_duphandle, and performs a transfer without resetting the cookie source, causing libcurl to load the attacker's cookies.

How to fix it

Upgrade libcurl to a build containing commit 172e54cda18412da73fd8eb4e444e8a5b371ca59 or newer; rebuild and redeploy all dependent applications after the update.

How to confirm the fix worked

Confirm the installed libcurl source or binary incorporates commit 172e54cda18412da73fd8eb4e444e8a5b371ca59; test by duplicating cookie-enabled handles and verifying no accidental load from a 'none' file occurs.

Typical attack path

1. Place a malicious cookie jar file named 'none' in the current working directory of the target process
2. Trigger the application to initialize a libcurl easy handle and enable cookie handling without specifying a source file
3. Invoke curl_easy_duphandle on the handle to clone the cookie state as 'none'
4. Perform a subsequent transfer to force loading of cookies from the attacker-controlled 'none' file

How to detect it

Inspect process working directories for files literally named 'none' containing cookie data; review application and system logs for unexpected cookie jar accesses or transfers involving unusual cookie values.

What your security team should do

• Prioritize updating all libcurl instances to the fixed commit across the environment
• Review and harden cookie handling code paths in applications using libcurl
• Scan for and remove any unexpected 'none' files in directories used as working directories by curl-based processes