CVE-2020-8284: Haxx Curl Information Disclosure Flaw

CVE-2020-8284 Overview

CVE-2020-8284 is an information disclosure vulnerability in curl 7.73.0 and earlier versions that allows a malicious FTP server to manipulate the PASV response to trick curl into connecting to an arbitrary IP address and port. This vulnerability enables attackers to potentially extract information about internal services that would otherwise be private and undisclosed, facilitating port scanning and service banner extraction attacks.

Critical Impact

A malicious server can abuse the FTP passive mode response to redirect curl connections, enabling reconnaissance of internal network services and potential information leakage from otherwise protected systems.

Affected Products

• haxx curl (versions up to 7.73.0)
• Apple Mac OS X and macOS (various versions)
• Debian Linux 9.0 and 10.0
• Fedora 32 and 33
• NetApp Clustered Data ONTAP, HCI Management Node, SolidFire
• Oracle Communications Billing and Revenue Management, Essbase, PeopleSoft Enterprise PeopleTools
• Siemens SINEC Infrastructure Network Services
• Splunk Universal Forwarder
• Fujitsu M10 and M12 series firmware

Discovery Timeline

• December 14, 2020 - CVE-2020-8284 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-8284

Vulnerability Analysis

This vulnerability exploits a weakness in how curl handles FTP passive mode (PASV) responses. When curl connects to an FTP server in passive mode, the server responds with an IP address and port number that the client should connect to for data transfer. In vulnerable versions, curl trusts this server-provided address without proper validation, allowing a malicious server to redirect the data connection to any arbitrary destination.

The impact of this vulnerability centers on information disclosure. An attacker controlling a malicious FTP server can instruct curl to connect to internal network addresses, effectively using the curl client as a proxy for port scanning and service enumeration. This could expose information about internal infrastructure that would otherwise be protected by network segmentation or firewalls.

Root Cause

The root cause of CVE-2020-8284 is improper validation of the IP address and port information returned in FTP PASV responses. Curl's FTP implementation trusted the server-provided connection details without verifying that the address matches the original server or falls within expected network boundaries. This trust-based design assumption proved exploitable when interacting with malicious FTP servers.

Attack Vector

The attack requires a victim to connect to a malicious FTP server using curl. The attack vector is network-based and unfolds as follows:

1. An attacker sets up a malicious FTP server that responds to PASV commands with crafted IP addresses
2. When a victim connects using curl and initiates a file transfer in passive mode, curl sends the PASV command
3. The malicious server responds with an IP address pointing to an internal service the attacker wants to probe
4. Curl connects to the attacker-specified address and port, potentially receiving service banners or connection responses
5. This information is returned through the FTP session, allowing the attacker to enumerate internal services

The attack enables Server-Side Request Forgery (SSRF)-like behavior through FTP protocol manipulation. An attacker could systematically scan internal networks by cycling through IP addresses and ports in successive PASV responses, using the victim's curl client as a scanning proxy.

Detection Methods for CVE-2020-8284

Indicators of Compromise

• Unusual FTP PASV responses directing connections to internal RFC 1918 addresses (10.x.x.x, 172.16.x.x-172.31.x.x, 192.168.x.x)
• FTP data connections to IP addresses different from the control connection server
• Rapid successive FTP connections to various ports suggesting port scanning activity
• Outbound connections from curl processes to unexpected internal network destinations

Detection Strategies

• Monitor FTP traffic for PASV responses containing IP addresses that differ from the server's actual address
• Implement network-level detection for FTP data connections being redirected to internal networks
• Deploy host-based monitoring to identify curl processes making connections to internal services following FTP sessions
• Review firewall logs for anomalous connection patterns from systems running curl-based applications

Monitoring Recommendations

• Enable verbose logging for applications using libcurl to track FTP session behavior
• Monitor for connections from curl processes to internal network segments that should not be accessed via FTP
• Implement egress filtering to detect and block FTP data connections to unauthorized internal addresses
• Set up alerts for high volumes of failed connection attempts that may indicate port scanning activity

How to Mitigate CVE-2020-8284

Immediate Actions Required

• Upgrade curl to version 7.74.0 or later which includes the --ftp-skip-pasv-ip option defaulting to enabled
• Audit systems and applications that use libcurl for FTP functionality to identify vulnerable deployments
• Apply vendor-specific patches for affected products including Apple macOS, Debian, Fedora, and Oracle products
• Consider blocking FTP access to untrusted servers until patches can be applied

Patch Information

The curl project addressed this vulnerability in version 7.74.0 by introducing the --ftp-skip-pasv-ip command-line option and the CURLOPT_FTP_SKIP_PASV_IP libcurl option, which ignore the IP address in the PASV response and use the original server IP instead. Multiple vendors have released patches including:

• Official curl Security Advisory
• Debian Security Advisory DSA-4881
• Apple Security Updates HT212325, HT212326, HT212327
• Oracle Critical Patch Updates
• Siemens Security Advisory SSA-389290
• NetApp Security Advisory NTAP-20210122-0007

Workarounds

• Use the --ftp-skip-pasv-ip option when running curl commands if upgrading is not immediately possible
• Configure firewall rules to restrict FTP data connections to known, trusted destinations only
• Avoid using FTP with untrusted servers; consider using SFTP or HTTPS alternatives where possible
• Implement network segmentation to limit the potential impact if internal services are probed

# Mitigation configuration example
# Use --ftp-skip-pasv-ip to ignore server-provided IP in PASV response
curl --ftp-skip-pasv-ip ftp://example.com/file.txt

# For libcurl applications, set the CURLOPT_FTP_SKIP_PASV_IP option
# curl_easy_setopt(curl, CURLOPT_FTP_SKIP_PASV_IP, 1L);

# Firewall rule to restrict FTP data connections (iptables example)
iptables -A OUTPUT -p tcp --dport 1024:65535 -m owner --uid-owner curl-user \
  -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -p tcp --dport 1024:65535 -m owner --uid-owner curl-user \
  -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -p tcp --dport 1024:65535 -m owner --uid-owner curl-user \
  -d 192.168.0.0/16 -j DROP