CVE-2022-43552: Open Source Curl Remote Code Execution Vulnerability

What is the curl open-source project?

Curl is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various network protocols. The name stands for "Client for URL". The Windows implementation provides access to the command-line tool, not the library.

What version of curl addresses this CVE?

Curl version 7.87.0 addresses this vulnerability.

Is CVE-2022-43552 going to be addressed in all supported versions of Windows?

Supported versions of Windows will be updated in a future security release after the March 14, 2023 release. This CVE will be updated when the update is available. Use the Security Update Guide Profile to sign up for automatic notifications.

Where can I find more information about this curl vulnerability?

More information can be found at NVD and curl.se

Are there any workarounds that can be implemented?

Preventing the execution of curl.exe is a workaround to be considered

Use a WDAC policy to deny execution of the \system32\curle.exe executable. You can merge the deny into an existing policy or create a new policy with it using the Merge-CIPolicy cmdlet; Merge-CIPolicy (ConfigCI) | Microsoft Learn. Once the policy XML file with the deny has been created or merged with an existing policy it must be deployed.

Choose how to deploy the policy; Deploying Windows Defender Application Control (WDAC) policies | Microsoft Learn

• Deploy using a Mobile Device Management (MDM) solution, such as Microsoft Intune
• Deploy using Microsoft Configuration Manager
• Deploy via script
• Deploy via group policy

For example:

Create a new policy: (These steps will create a new policy named Deny-Curl.xml by merging the deny using the example policy named AllowAll.xml)

$rule = new-cipolicyrule -DriverFilePath "$env:systemroot\system32\curl.exe" -Level FilePublisher -Deny
$rule[0].attributes["MinimumFileVersion"] = "0.0.0.0"
$rule[0].attributes["MaximumFileVersion"] = "7.87.0.0"

merge-cipolicy "$env:systemroot\schemas\CodeIntegrity\ExamplePolicies\AllowAll.xml" -Rules $rule -OutputFilePath "Deny-Curl.xml"

Merge into an existing policy

$rule = new-cipolicyrule -DriverFilePath "$env:systemroot\system32\curl.exe" -Level FilePublisher -Deny
$rule[0].attributes["MinimumFileVersion"] = "0.0.0.0"
$rule[0].attributes["MaximumFileVersion"] = "7.87.0.0"

merge-cipolicy "existing_policy.xml" -Rules $rule -OutputFilePath "existing_policy.xml"