CVE-2023-23915: HSTS amnesia with --parallel
What the report claims
curl overwrites HSTS cache entries when requests are performed in parallel, causing some HSTS entries to be lost and insecure connections to be made.
Compare with curl's recorded outcome
Known vulnerability
A real vulnerability: CVE-2023-23915 HSTS amnesia with --parallel
Shown for comparison after analysis. The pipeline did not see this label.
ProveIt's finding
The available evidence does not settle the report. A maintainer should investigate.
Why this finding?
- The report describes a specific, plausible flaw in HSTS cache handling with --parallel
- The provided code snippet (lib/urldata.h lines 170-238) does not contain the HSTS implementation, parallel request handling, or cache file writing code
- Deterministic checks returned 'nothing_to_check', confirming the relevant code was not in the provided context
- A human reviewer needs to examine the actual HSTS cache code (likely in lib/hsts.c or similar) and the parallel execution path
What still needs checking
- The HSTS cache implementation source code (e.g., lib/hsts.c)
- The parallel request handling code that manages multiple simultaneous transfers
- The code that writes/reads the HSTS cache file (hsts.txt)
How this analysis ran 6 claims · 0 citations verified
Checked against curl master on 2022-12-21 (c12fb3ddaf48). Dev evaluation split. Citation verification checks that a referenced line was in the evidence; it does not prove the model interpreted it correctly.
Review a draft reply to the reporter
Edit and verify before sending.
Thank you for the detailed report. The provided code snippet does not include the HSTS cache implementation or parallel request handling logic needed to verify this issue. Could you point to the specific files/functions you believe are involved (e.g., the HSTS cache read/write code and the parallel transfer coordination)? This will help us locate and assess the flaw.
Inspect all claims and source code 6 claims · 1 code excerpts
Report claims
curl overwrites HSTS cache entries if requests are performed in parallel
Read the reasoning
The provided code snippet (lib/urldata.h lines 170-238) only shows the CURLcode typedef and some constants. It does not contain the HSTS cache implementation or parallel request handling code needed to evaluate this claim.
in the HSTS cache implementation
Read the reasoning
The provided code does not include the HSTS cache implementation. The snippet is from urldata.h and contains no HSTS-related code.
when requests are performed in parallel using --parallel
Read the reasoning
The provided code does not include the --parallel implementation or the code that handles parallel requests. The snippet is from urldata.h and contains no parallel-related code.
Only one of the sites contacted will have entry in hsts.txt afterwards
Read the reasoning
This is an impact claim about the resulting hsts.txt file. The provided code does not show the HSTS file writing logic, so the claim cannot be verified from the given source.
Non-TLS connection to the other sites will not protected by TLS
Read the reasoning
This is an impact claim about security consequences. The provided code does not contain the relevant HSTS or connection logic to evaluate whether non-TLS connections would occur.
curl --parallel --hsts hsts.txt https://site1.tld https://site2.tld https://site3.tld
Read the reasoning
This is a reproduction command, not a code claim. It cannot be verified against the provided code snippet which lacks the relevant implementation.
Read the original report
Source code
| 170 | typedef CURLcode (*Curl_datastream)(struct Curl_easy *data, |
| 171 | struct connectdata *conn, |
| 172 | int *didwhat, |
| 173 | bool *done, |
| 174 | int select_res); |
| 175 | #endif |
| 176 | |
| 177 | #include "mime.h" |
| 178 | #include "imap.h" |
| 179 | #include "pop3.h" |
| 180 | #include "smtp.h" |
| 181 | #include "ftp.h" |
| 182 | #include "file.h" |
| 183 | #include "vssh/ssh.h" |
| 184 | #include "http.h" |
| 185 | #include "rtsp.h" |
| 186 | #include "smb.h" |
| 187 | #include "mqtt.h" |
| 188 | #include "wildcard.h" |
| 189 | #include "multihandle.h" |
| 190 | #include "quic.h" |
| 191 | #include "c-hyper.h" |
| 192 | |
| 193 | #ifdef HAVE_GSSAPI |
| 194 | # ifdef HAVE_GSSGNU |
| 195 | # include <gss.h> |
| 196 | # elif defined HAVE_GSSAPI_GSSAPI_H |
| 197 | # include <gssapi/gssapi.h> |
| 198 | # else |
| 199 | # include <gssapi.h> |
| 200 | # endif |
| 201 | # ifdef HAVE_GSSAPI_GSSAPI_GENERIC_H |
| 202 | # include <gssapi/gssapi_generic.h> |
| 203 | # endif |
| 204 | #endif |
| 205 | |
| 206 | #ifdef USE_LIBSSH2 |
| 207 | #include <libssh2.h> |
| 208 | #include <libssh2_sftp.h> |
| 209 | #endif /* USE_LIBSSH2 */ |
| 210 | |
| 211 | #define READBUFFER_SIZE CURL_MAX_WRITE_SIZE |
| 212 | #define READBUFFER_MAX CURL_MAX_READ_SIZE |
| 213 | #define READBUFFER_MIN 1024 |
| 214 | |
| 215 | /* The default upload buffer size, should not be smaller than |
| 216 | CURL_MAX_WRITE_SIZE, as it needs to hold a full buffer as could be sent in |
| 217 | a write callback. |
| 218 | |
| 219 | The size was 16KB for many years but was bumped to 64KB because it makes |
| 220 | libcurl able to do significantly faster uploads in some circumstances. Even |
| 221 | larger buffers can help further, but this is deemed a fair memory/speed |
| 222 | compromise. */ |
| 223 | #define UPLOADBUFFER_DEFAULT 65536 |
| 224 | #define UPLOADBUFFER_MAX (2*1024*1024) |
| 225 | #define UPLOADBUFFER_MIN CURL_MAX_WRITE_SIZE |
| 226 | |
| 227 | #define CURLEASY_MAGIC_NUMBER 0xc0dedbadU |
| 228 | #define GOOD_EASY_HANDLE(x) \ |
| 229 | ((x) && ((x)->magic == CURLEASY_MAGIC_NUMBER)) |
| 230 | |
| 231 | #ifdef HAVE_GSSAPI |
| 232 | /* Types needed for krb5-ftp connections */ |
| 233 | struct krb5buffer { |
| 234 | void *data; |
| 235 | size_t size; |
| 236 | size_t index; |
| 237 | BIT(eof_flag); |
| 238 | }; |