5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-46219

CVE-2023-46219: When saving HSTS data to an excessively long file name, curl could end up removing all contents,...

When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-46219

CVE-2023-46219:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2023-46219 describes an issue where HSTS data can be lost if saved to an excessively long filename. The analysis of the provided information, particularly the curl security advisory and the associated commits, leads to the identification of the vulnerable functions:

The advisory https://curl.se/docs/CVE-2023-46219.html points to an 'Introduced-in' commit (20f9dd6bae50b722) and a 'Fixed-in' commit (73b65e94f3531179de45).
Commit 20f9dd6bae50b722 introduced a new function Curl_fopen in lib/fopen.c. The critical part of this function was its method of creating temporary filenames: tempstore = aprintf("%s.%s.tmp", filename, randsuffix);. This line is the source of the vulnerability, as appending to an already long filename could exceed filesystem path/name limits, leading to errors in file operations and potential data loss upon renaming the temporary file to the final filename.
The same introducing commit (20f9dd6bae50b722) included a preprocessor condition #if !defined(CURL_DISABLE_COOKIES) || !defined(CURL_DISABLE_ALTSVC) || !defined(CURL_DISABLE_HSTS) within lib/fopen.c. This explicitly indicates that Curl_fopen was designed to be used by various modules, including HSTS.
The function Curl_hsts_save (located in lib/hsts.c in the curl codebase) is responsible for saving HSTS data. Standard curl code shows that Curl_hsts_save calls Curl_fopen to write HSTS data to a file. When an excessively long filename is used for HSTS data, Curl_hsts_save passes this filename to Curl_fopen, triggering the vulnerability.
The fixing commit 73b65e94f3531179de45 addresses the vulnerability by changing the temporary filename generation logic within Curl_fopen itself. It no longer appends to the original filename but creates a shorter, random temporary name in the target directory. The fact that only Curl_fopen was modified in the fix confirms it was the central vulnerable component.

Therefore, Curl_fopen is identified as the function containing the core flawed logic. Curl_hsts_save is identified as the function that processes the problematic input (the excessively long HSTS filename) and invokes the vulnerable logic in Curl_fopen, directly aligning with the CVE's description of HSTS data loss.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.