CVE-2022-32208: Haxx Curl FTP Krb5 MITM Vulnerability

CVE-2022-32208 Overview

CVE-2022-32208 affects curl versions prior to 7.84.0 when performing FTP transfers secured by Kerberos 5 (krb5). The library mishandles message verification failures during these transfers. An attacker positioned between the client and server can exploit this flaw to mount a Man-In-The-Middle (MITM) attack without detection and inject arbitrary data into the client's session.

The vulnerability is classified under [CWE-840] (Business Logic Errors) and [CWE-787] (Out-of-bounds Write). It impacts confidentiality through unnoticed interception, while integrity of received data is also at risk through injection.

Critical Impact
Network-positioned attackers can intercept and tamper with krb5-protected FTP traffic without triggering verification errors, breaking the security guarantees of Kerberos-secured FTP transfers.

Affected Products

Haxx curl versions prior to 7.84.0
Debian Linux 10.0 and 11.0, Fedora 35, and Gentoo Linux distributions shipping vulnerable curl packages
NetApp Clustered Data ONTAP, Element Software, HCI Management Node, SolidFire, HCI Compute Node, Bootstrap OS, and H-Series storage appliances (H300S, H500S, H700S, H410S)
Apple macOS (addressed in Apple Support Article HT213488)
Splunk Universal Forwarder (including 9.1.0)

Discovery Timeline

2022-07-07 - CVE-2022-32208 published to NVD
2025-05-05 - Last updated in NVD database

Technical Details for CVE-2022-32208

Vulnerability Analysis

The defect resides in curl's krb5-secured FTP transfer logic. When curl negotiates a Kerberos-protected FTP session, each data message is supposed to be authenticated using GSSAPI message integrity checks. The library was supposed to abort the transfer or surface an error when a verification check failed. Instead, curl continued processing the affected messages as if they were trusted.

This behavior eliminates the integrity protection that krb5 is designed to provide on FTP control and data channels. Attackers controlling the network path between the client and the FTP server can modify or inject ciphertext blocks. The client accepts the tampered data because the failed verification result is not propagated to the calling application.

The issue is documented in HackerOne Report #1590071 and the curl 7.84.0 release notes.

Root Cause

The root cause is improper handling of GSSAPI verification return codes in curl's krb5 FTP code path. The verification routine could return a failure indication that the surrounding code did not check correctly. Because the failure was treated as success, message contents were passed back to the caller without integrity guarantees.

Attack Vector

Exploitation requires a network-adjacent attacker capable of intercepting and modifying traffic between the curl-based FTP client and the target FTP server. High attack complexity reflects the need for the attacker to be on-path and to manipulate Kerberos-wrapped FTP messages without breaking the underlying session state. No user interaction or privileges on the client system are required.

The vulnerability is described in prose because no public proof-of-concept exploit code is available. The attack flow involves intercepting krb5-wrapped FTP responses, modifying the encrypted payload, and forwarding the manipulated message to the client, which accepts it despite the failed integrity check.

Detection Methods for CVE-2022-32208

Indicators of Compromise

Unexpected content or corrupted files returned from FTP transfers that use the --krb option or Kerberos-protected FTP endpoints
FTP sessions completing successfully despite network anomalies such as latency spikes, duplicated TCP segments, or proxy rewrites
Hosts running curl versions earlier than 7.84.0 initiating outbound FTP connections to external servers

Detection Strategies

Inventory installed curl versions across endpoints, servers, and storage appliances and flag any build older than 7.84.0
Audit application code and shell scripts for curl invocations that use ftp:// URLs combined with --krb or GSSAPI credentials
Correlate FTP traffic flows with the presence of Kerberos service tickets for ftp/ service principals to identify in-scope sessions

Monitoring Recommendations

Capture and log curl command-line arguments through endpoint process telemetry to surface krb5 FTP usage
Monitor outbound port 21 traffic and alert on FTP sessions originating from systems that have not been patched
Review NetApp, Splunk, and macOS vendor advisories on a recurring basis and track applied fixes in your configuration management database

How to Mitigate CVE-2022-32208

Immediate Actions Required

Upgrade curl and libcurl to version 7.84.0 or later on every affected host, container image, and build pipeline
Apply vendor-specific patches from NetApp (NTAP-20220915-0003), Apple (HT213488), Debian (DSA-5197), Fedora, and Gentoo (GLSA 202212-01)
Inventory third-party applications and appliances that statically link or bundle curl and request updated builds from the vendor

Patch Information

The curl project fixed this issue in version 7.84.0, released on June 27, 2022. Linux distributions and appliance vendors released backported patches throughout the second half of 2022. See the Debian LTS announcement and the Fedora package announcement for distribution-specific package versions.

Workarounds

Avoid using curl's krb5 FTP feature until the host is patched by removing --krb flags from scripts and applications
Replace FTP with SFTP or FTPS over TLS for file transfers, which are not affected by this specific verification bug
Restrict outbound FTP traffic at the network egress layer to a small set of trusted destinations until upgrades are complete

bash

# Verify curl version and remove krb5 FTP usage
curl --version | head -n 1
# Expected output should report 7.84.0 or later, for example:
# curl 7.84.0 (x86_64-pc-linux-gnu) libcurl/7.84.0 ...

# Debian/Ubuntu: apply distribution updates
sudo apt-get update && sudo apt-get install --only-upgrade curl libcurl4

# RHEL/Fedora
sudo dnf upgrade --refresh curl libcurl