The maintainers of curl have informed us about two vulnerabilities in the software that will be fixed on the 11th of october. CVE-2023-38545 has a high serverity and affects both libcurl and the curl tool. This page can help you identify systems that run curl beforehand, in order for you to take imidiate action if needed. As advised by multiple security organisations your company should create an inventory of all systems that run curl. This can be done by running the following queries in Defender For Endpoint.
search
InitiatingProcessFileName:"curl.exe" or
InitiatingProcessVersionInfoOriginalFileName:"curl.exe" or
ProcessVersionInfoOriginalFileName:"curl.exe" or
ProcessVersionInfoInternalFileName:"curl" or
InitiatingProcessVersionInfoInternalFileName:"curl"
| distinct $table
DeviceNetworkEvents
| where ActionType endswith "ConnectionInspected"
| where AdditionalFields contains "curl"
| extend UserAgent = parse_json(AdditionalFields).user_agent
| where UserAgent contains "curl"
- https://www.kustoking.com/hunting-for-curl/
- https://www.rezilion.com/blog/cve-2023-38545-a-high-severity-curl-and-libcurl-cve-to-be-published-on-october-11th/
- https://blog.qualys.com/vulnerabilities-threat-research/2023/10/05/curl-8-4-0-proactively-identifying-potential-vulnerable-assets
- https://www.docker.com/blog/security-advisory-high-severity-curl-vulnerability/