CVE-2009-0037: CSRF

Published Mar 5, 2009

Updated

The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPTFOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3) execute arbitrary commands via a redirect to an scp: URL.

Affected Software

80 affected components

curl curl=7.10.7

curl curl=7.10.3

curl curl=7.3

curl curl=7.1

curl curl=6.4

curl curl=5.11

curl curl=7.14.1

curl curl=7.9.1

curl libcurl=7.14

curl curl=6.1beta

curl curl=7.16.3

curl libcurl=7.14.1

curl curl=7.9.2

curl curl=7.14

curl curl=7.4

curl curl=7.9.3

curl curl=6.3

curl libcurl=7.12.2

curl curl=6.5.1

curl curl=7.4.1

curl curl=7.10.4

curl curl=7.15.3

curl curl=7.5.2

curl libcurl=7.13.1

curl libcurl=7.12.1

curl curl=7.2.1

curl curl=6.0

curl curl=7.7.3

curl curl=7.10.5

curl libcurl=5.11

curl curl=7.9.8

curl curl=7.7

curl curl=7.10.1

curl curl=7.16.4

curl libcurl=7.13

curl curl=7.2

curl curl=7.10.6

curl curl=7.8

curl curl=7.13

curl libcurl=7.15.2

curl curl=6.3.1

curl curl=7.12.1

curl libcurl=7.15.3

curl libcurl=7.12.3

curl curl=7.9.6

curl curl=7.8.1

curl curl=7.15.1

curl curl=7.7.2

curl curl=7.9.5

curl curl=7.10.2

curl libcurl=7.19.3

curl curl=7.9

curl curl=7.17

curl curl=7.9.7

curl curl=7.10

curl libcurl=7.15.1

curl curl=7.19.3

curl libcurl=7.12

curl curl=7.6.1

curl curl=7.9.4

curl curl=6.2

curl curl=7.13.2

curl curl=7.8.2

curl curl=7.5

curl curl=7.15

curl curl=7.6

curl libcurl=7.16.3

curl curl=7.7.1

curl libcurl=7.13.2

curl curl=7.10.8

curl libcurl=7.15

curl curl=7.18

curl curl=6.5

curl curl=6.5.2

curl curl=7.1.1

curl curl=7.12.2

curl curl=7.12

curl curl=7.11.1

curl curl=7.4.2

curl curl=7.5.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
For curl and libcurl versions 5.11 through 7.19.3, disable CURLOPT_FOLLOWLOCATION (set it to false) so the library does not automatically follow Location redirects, preventing arbitrary Location values from triggering intranet requests, file: URLs, or scp: URLs.
curl/libcurl CURLOPT_FOLLOWLOCATION = false

Event History

Mar 5, 2009

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Data Sourced

via NVD·02:30 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2009-0037?

CVE-2009-0037 is considered a moderate severity vulnerability that can lead to arbitrary requests to intranet servers.

How do I fix CVE-2009-0037?

To fix CVE-2009-0037, update curl or libcurl to versions 7.19.4 or later.

What software is affected by CVE-2009-0037?

CVE-2009-0037 affects multiple versions of curl and libcurl, specifically from versions 5.11 to 7.19.3.

What is the impact of CVE-2009-0037?

CVE-2009-0037 may allow remote HTTP servers to read or overwrite arbitrary files or initiate requests to internal systems.

Is CVE-2009-0037 a remote code execution vulnerability?

No, CVE-2009-0037 does not directly allow remote code execution, but it can facilitate unauthorized requests to internal services.