Potential curl CVE-2023-38545 Exploitation

Detects potential exploitation of curl CVE-2023-38545 by monitoring for vulnerable command line arguments in conjunction with an unusual command line length. A flaw in curl version ⇐ 8.3 makes curl vulnerable to a heap based buffer overflow during the SOCKS5 proxy handshake. Upgrade to curl version >= 8.4 to patch this vulnerability. This exploit can be executed with and without the use of environment variables. For increased visibility, enable the collection of http_proxy, HTTPS_PROXY and ALL_PROXY environment variables based on the instructions provided in the setup guide of this rule.

Rule type: eql

Rule indices:

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Version: 4

Rule authors:

Rule license: Elastic License v2

process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and process.name == "curl"
and (
  process.args : ("--socks5-hostname", "--proxy", "--preproxy", "socks5*") or
  process.env_vars: ("http_proxy=socks5h://*", "HTTPS_PROXY=socks5h://*", "ALL_PROXY=socks5h://*")
) and length(process.command_line) > 255 and
not process.parent.name in ("cf-agent", "agent-run", "rudder", "agent-inventory", "cf-execd")