CVE-2020-8285: Haxx Libcurl Buffer Overflow Vulnerability

CVE-2020-8285 Overview

CVE-2020-8285 is a stack overflow vulnerability in the curl command-line tool and libcurl library affecting versions 7.21.0 through 7.73.0. The vulnerability exists in the FTP wildcard matching functionality, where uncontrolled recursion can lead to a stack overflow condition. When a curl client processes specially crafted FTP server responses containing deeply nested wildcard patterns, it can exhaust stack space and crash, resulting in a denial of service condition.

This vulnerability is particularly concerning because curl and libcurl are among the most widely deployed network transfer tools, embedded in countless applications, operating systems, and network appliances across enterprise environments.

Critical Impact

Attackers can trigger a denial of service by causing stack exhaustion through malicious FTP wildcard patterns, potentially disrupting critical services that rely on curl for data transfers.

Affected Products

• Haxx libcurl versions 7.21.0 to 7.73.0
• Apple macOS and Mac OS X (multiple versions)
• Debian Linux 9.0 and 10.0
• Fedora 32 and 33
• NetApp Clustered Data ONTAP, HCI Management Node, SolidFire, and HCI Storage/Compute Nodes
• Oracle Communications Billing and Revenue Management 12.0.0.3.0
• Oracle Communications Cloud Native Core Policy 1.14.0
• Oracle Essbase 21.2
• Oracle PeopleSoft Enterprise PeopleTools 8.58
• Fujitsu M10 and M12 series firmware
• Siemens SINEC Infrastructure Network Services
• Splunk Universal Forwarder

Discovery Timeline

• December 14, 2020 - CVE-2020-8285 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-8285

Vulnerability Analysis

The vulnerability resides in curl's FTP wildcard matching implementation, which is used when retrieving files from FTP servers using glob patterns. The parser processes wildcard patterns recursively without adequate depth limitations, allowing an attacker controlling an FTP server (or performing a man-in-the-middle attack) to craft responses that trigger excessive recursion.

When curl connects to an FTP server and requests files using wildcard patterns (e.g., *.txt or [a-z]*.log), the server's directory listing response is processed by curl's wildcard matching engine. If the pattern matching logic encounters deeply nested bracket expressions or complex pattern combinations, it recurses without proper bounds checking. This causes the call stack to grow until available stack memory is exhausted.

The vulnerability can be triggered remotely over the network without requiring authentication. The impact is limited to availability since the stack overflow results in a crash rather than code execution due to modern stack protection mechanisms.

Root Cause

The root cause is uncontrolled recursion (CWE-674) in the FTP wildcard pattern matching code. The recursive function responsible for evaluating glob-style patterns did not implement adequate recursion depth limits. This allowed specially crafted input to cause unbounded recursive calls, eventually exceeding the process's stack allocation and triggering a crash.

The wildcard matching functionality, while useful for retrieving multiple files with pattern matching, was not designed with adversarial input in mind. The code assumed pattern complexity would be bounded by typical user input rather than potentially malicious server responses.

Attack Vector

The attack vector is network-based and requires the victim's curl client to connect to a malicious or compromised FTP server. The attack can be executed through several scenarios:

An attacker operating a malicious FTP server can craft directory listing responses containing patterns designed to maximize recursion depth when processed by curl's wildcard matching engine.

The malicious FTP server responds with crafted file listings that exploit the recursive pattern matching. When curl attempts to match requested patterns against these listings, the uncontrolled recursion exhausts stack space, causing the curl process to crash.

This attack requires user interaction to initiate the FTP connection, though in automated environments where curl connects to external FTP servers, exploitation could occur without direct user involvement.

Detection Methods for CVE-2020-8285

Indicators of Compromise

• Unexpected curl process crashes when connecting to FTP servers
• Stack overflow errors in system logs associated with curl or applications using libcurl
• FTP server responses containing unusually complex or deeply nested patterns in directory listings
• Repeated service restarts for applications depending on libcurl for FTP transfers

Detection Strategies

• Monitor for curl process crashes accompanied by stack overflow signals (SIGSEGV with stack-related indicators)
• Implement network monitoring to detect FTP connections to untrusted or newly registered domains
• Deploy application crash analysis to identify stack exhaustion patterns in curl-dependent services
• Review system logs for abnormal termination of processes utilizing libcurl FTP functionality

Monitoring Recommendations

• Configure crash dump collection for curl processes and applications using libcurl
• Establish baseline metrics for FTP transfer operations and alert on abnormal failure rates
• Monitor for FTP connections to suspicious or unknown external servers
• Implement endpoint detection rules for stack overflow conditions in network transfer utilities

How to Mitigate CVE-2020-8285

Immediate Actions Required

• Upgrade curl and libcurl to version 7.74.0 or later, which contains the fix for this vulnerability
• Audit systems and applications to identify all instances of curl/libcurl requiring updates
• Restrict FTP connections to known trusted servers where possible
• Consider disabling FTP wildcard matching functionality if not required for operations

Patch Information

The curl project addressed this vulnerability in version 7.74.0, released in December 2020. The fix implements proper recursion depth limits in the FTP wildcard matching code to prevent stack exhaustion.

Patches and updates are available from:

• Official curl CVE-2020-8285 Advisory
• Debian Security Advisory DSA-4881
• Apple Security Updates HT212325, HT212326, HT212327
• NetApp Security Advisory NTAP-20210122-0007
• Oracle Critical Patch Update April 2021
• Siemens Security Advisory SSA-389290

Workarounds

• Avoid using FTP wildcard matching features when connecting to untrusted servers
• Configure network policies to restrict FTP connections to approved internal servers only
• Deploy application-level controls to validate FTP server responses before processing
• Consider using SFTP or other secure transfer protocols instead of FTP where feasible

# Verify installed curl version
curl --version

# Check if libcurl is updated on Linux systems
apt-cache policy libcurl4 # Debian/Ubuntu
rpm -q curl libcurl       # RHEL/CentOS

# Upgrade curl on Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade curl libcurl4

# Upgrade curl on RHEL/CentOS
sudo yum update curl libcurl