Curl高危漏洞（CVE-2023-38545）分析报告及建议

名称

版本号

libcurl

7.69.0 <= libcurl < 8.4.0

curl --version

strings libcurl.so | egrep -o 'libcurl[ -/]([678]+.[0-9]+.[0-9]+)'

lsof | egrep -o '/.*.so.*' | xargs -I {} bash -c "strings {} | egrep -o 'libcurl[ -/]([678]+.[0-9]+.[0-9]+)'"

ldconfig -p | grep libcurl

dpkg -l | grep libcurl

import platform

import subprocess

import os

def get_curl_version():

operating_system = platform.system().lower()

if "windows" in operating_system:

return get_windows_curl_version()

elif "linux" in operating_system:

return get_linux_curl_version()

elif "darwin" in operating_system:

return "NA"

else:

return "Unsupported operating system"

def get_libcurl():

uname_output = subprocess.run(['uname', '-a'], capture_output=True, text=True)

uname_output = uname_output.stdout.lower()

if "linux" in uname_output:

return get_linux_libcurl()

elif "darwin" in uname_output:

return get_macos_libcurl()

else:

return "Unsupported operating system"

def get_windows_curl_version():

try:

result = subprocess.run(['curl', '--version'], capture_output=True, text=True)

lines = result.stdout.strip().splitlines()

return lines[0]

except FileNotFoundError:

return "curl is not installed on Windows"

def get_linux_curl_version():

try:

result = subprocess.run(['curl', '--version'], capture_output=True, text=True)

lines = result.stdout.strip().splitlines()

return lines[0]

except FileNotFoundError:

import pycurl

print(pycurl.version)

print(pycurl.__file__)

输出：

windows:

PycURL/7.43.0.5 libcurl/7.68.0 OpenSSL/1.1.1d zlib/1.2.11 c-ares/1.15.0 WinIDN libssh2/1.9.0 nghttp2/1.40.0

C:Python38libsite-packagespycurl.cp38-win_amd64.pyd

linux:

libcurl/7.29.0 NSS/3.53.1 zlib/1.2.7 libidn/1.28 libssh2/1.8.0

/usr/lib64/python2.7/site-packages/pycurl.so

sudo find / -name "curl" -o -name "*libcurl*"

import re

# 定义正则表达式模式

pattern = re.compile(r'([678]+.[0-9]+.[0-9]+)')

# 从 path.txt 文件中读取文件路径

with open('path.txt', 'r') as path_file:

for line in path_file:

file_path = line.strip('"n').strip("'n") # 删除双引号、单引号、换行、空白

try:

with open(file_path, 'r', encoding='ascii', errors='ignore') as file:

contents = file.read()

match = pattern.search(contents)

if match:

print(f"{file_path}n版本：{match.group(1)}")

else:

print(f"{file_path}n检测版本失败，请确认文件无误")

except:

print(f"{file_path}n检测版本失败，请确认路径及文件权限")

import win32api

import subprocess

import pefile

import argparse

def is_16_bit_exe(file_path):

with open(file_path, 'rb') as f:

# Read the MZ header

mz_header = f.read(2)

# Check if it's a valid MZ header

if mz_header != b'MZ':

return False

f.seek(0x3C)

pe_header_addr = int.from_bytes(f.read(4), byteorder='little')

return pe_header_addr < 1024

def run_command(cmd):

try:

process = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, creationflags=subprocess.CREATE_NO_WINDOW)

out, err = process.communicate()

if process.returncode != 0:

return None

return out.decode(encoding="Gbk")

except Exception as e:

print(f"Error: {e}")

return None

def comparaV(v1):

lower_bound = [7, 69, 0]

upper_bound = [8, 4, 0]

input_version = list(map(int, v1.split('.')))

return lower_bound <= input_version < upper_bound

class EXE:

def __init__(self) -> None:

self.dllout = run_command("es.exe  curl.exe")

self.dllpath = self.dllout.splitlines()  # splitlines()将字符串分割成行的列表

print(len(self.dllpath))

sudo apt-get update && sudo apt-get install curl

sudo dnf upgrade curl

sudo yum update curl

brew install curl

/bin/bash -c “$(curl -

fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)”

echo ‘export PATH=”/usr/local/opt/curl/bin:$PATH”‘ >> ~/.bash_profile

Source your updated ~/.bash_profile:

.~/.bash_profile

curl --version