CVE-2021-22926: Haxx Curl Privilege Escalation Vulnerability

CVE-2021-22926 Overview

CVE-2021-22926 affects libcurl applications built against the macOS native TLS library Secure Transport. The CURLOPT_SSLCERT option (--cert in the command-line tool) accepts either a certificate name or a file name through the same parameter. When a file exists with the requested name, libcurl uses that file instead of the named certificate from the keychain. An attacker with write access to the application's current working directory can plant a file matching the expected certificate name. This tricks libcurl into sending the wrong client certificate during the TLS handshake, breaking the integrity of mutual authentication [CWE-295, CWE-840].

Critical Impact

A local attacker can manipulate which client certificate libcurl presents during a TLS handshake, disrupting authenticated transfers and causing denial of service for the affected application.

Affected Products

• Haxx curl (versions using Secure Transport backend on macOS)
• NetApp products including Active IQ Unified Manager, Clustered Data ONTAP, HCI Management Node, OnCommand Insight, OnCommand Workflow Automation, SnapCenter, SolidFire, and H-series firmware (H300S/E, H500S/E, H700S/E, H410S)
• Oracle MySQL Server, Oracle PeopleSoft Enterprise PeopleTools 8.57/8.58/8.59, Siemens SINEC INS, and Splunk Universal Forwarder

Discovery Timeline

• 2021-08-05 - CVE-2021-22926 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-22926

Vulnerability Analysis

The flaw resides in libcurl's Secure Transport backend on macOS. The CURLOPT_SSLCERT option overloads a single string to mean either a keychain certificate name or a path to a certificate file. libcurl resolves the ambiguity by checking if a file exists with the given name. If the file exists, libcurl loads it as the client certificate instead of looking up the keychain entry. The application's current working directory becomes a trust boundary it was never designed to enforce. The CWE-840 (Business Logic Errors) and CWE-295 (Improper Certificate Validation) classifications reflect both the input-overloading design flaw and the resulting certificate selection error.

Root Cause

The root cause is the dual-meaning interpretation of the CURLOPT_SSLCERT parameter combined with a filesystem lookup that takes precedence over the keychain lookup. libcurl never validates that the working directory is trustworthy before performing the existence check. Applications passing a keychain certificate name have no way to opt out of the implicit filesystem resolution.

Attack Vector

An attacker requires local write access to a directory that the target libcurl-using application uses as its current working directory. World-writable directories such as /tmp are typical examples. The attacker creates a file whose name matches the certificate identifier the application requests through CURLOPT_SSLCERT. When the application runs, libcurl reads the planted file and presents it as the client certificate during the TLS handshake. The remote server either rejects the handshake or accepts a connection authenticated with the wrong certificate, depending on its trust policy.

No proof-of-concept code or in-the-wild exploitation has been published, and CISA has not added this CVE to the Known Exploited Vulnerabilities catalog. The vulnerability is described in prose; see the curl security advisory for upstream details.

Detection Methods for CVE-2021-22926

Indicators of Compromise

• Unexpected files in world-writable directories whose names match certificate identifiers used by libcurl-based applications.
• TLS handshake failures or SSL_ERROR_BAD_CERTIFICATE responses from servers expecting mutual authentication from a known client.
• Application logs showing certificate selection that does not match the configured keychain identity.

Detection Strategies

• Audit libcurl-linked binaries on macOS hosts and inventory those compiled against Secure Transport.
• Monitor file creation events in /tmp and other shared writable paths for filenames resembling certificate aliases.
• Correlate TLS handshake errors from outbound clients with recent filesystem changes in the calling process's working directory.

Monitoring Recommendations

• Log the working directory of services and scheduled jobs that perform mutual TLS to detect unexpected chdir operations.
• Track outbound TLS connections from affected NetApp, Oracle, Siemens, and Splunk components against expected client certificate fingerprints.
• Review vendor advisories from NetApp NTAP-20210902-0003, Oracle CPU October 2021, and Siemens SSA-389290 for product-specific monitoring guidance.

How to Mitigate CVE-2021-22926

Immediate Actions Required

• Upgrade libcurl to version 7.78.0 or later on macOS systems using the Secure Transport backend.
• Apply vendor patches from NetApp, Oracle, Siemens, and Splunk for products that bundle vulnerable libcurl builds.
• Ensure libcurl-using services do not run with a current working directory under attacker control, such as /tmp.

Patch Information

The curl project addressed the issue in version 7.78.0. Downstream vendors shipped fixes in their respective advisories: NetApp NTAP-20210902-0003, NetApp NTAP-20211022-0003, Oracle CPU January 2022, Oracle CPU October 2021, Siemens SSA-389290, and Gentoo GLSA 202212-01.

Workarounds

• Set an explicit, non-writable working directory for any process invoking libcurl with CURLOPT_SSLCERT on macOS.
• Use absolute file paths for CURLOPT_SSLCERT when intending to load a certificate from disk, removing ambiguity between file and keychain lookups.
• Restrict permissions on /tmp and similar shared directories where feasible, or run affected services under a dedicated user account with a private working directory.

# Configuration example: launch a libcurl-based service with a private CWD
install -d -m 0700 -o svcuser /var/lib/myservice/cwd
cd /var/lib/myservice/cwd && exec /usr/local/bin/myservice --cert keychain-identity-name