CVE-2024-2004
CVE-2024-2004: curl protocol selection error. This vulnerability allows disabled protocols to remain active due to a logic flaw, potentially permitting unintended communication methods.
CVE-2024-2004 involves a curl command that attempts to disable all protocols, but fails to do so correctly. Consequently, if all protocols are disabled, the default set remains active, allowing requests via those protocols even when they should be blocked. The SVRS is 36, indicating a lower risk level. Although tagged "In The Wild," the issue is considered low severity by the curl security team since it requires a specific, largely impractical command to trigger and is unlikely to occur in typical usage scenarios. While the CVSS score is 0, understanding this vulnerability is essential for maintaining secure curl configurations and preventing unintended protocol usage.
Description:
CVE-2024-2004 is a vulnerability in the curl command-line tool that allows an attacker to bypass protocol restrictions and send plaintext requests over a disabled protocol. The vulnerability arises from an error in the logic for removing protocols when the --proto option is used to disable all protocols without adding any.
Key Insights:
- SVRS Score: 36, indicating a moderate risk.
- Exploit Status: Active exploits have been published.
- CISA Warnings: The Cybersecurity and Infrastructure Security Agency (CISA) has warned of the vulnerability, calling for immediate and necessary measures.
- In The Wild: The vulnerability is actively exploited by hackers.
Mitigation Strategies:
- Update curl to the latest version (7.88.0 or later).
- Avoid using the
--proto -all,-httpcommand, as it disables all protocols and leaves the default set of protocols allowed. - Use a web application firewall (WAF) to block malicious requests.
- Implement strict access controls to prevent unauthorized access to sensitive data.
Additional Information:
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.