CVE-2020-8284

A malicious server can use the PASV response to trick curl into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions. If curl operates on a URL provided by a user, a user can exploit that and pass in a URL to a malicious FTP server instance without needing any server breach to perform the attack.

Mitigation

This flaw can be mitigated in curl as shipped with Red Hat Enterprise Linux and Red Hat Software Collections when using curl by passing the --ftp-skip-pasv-ip command line option to curl. For usage of libcurl, set CURLOPT_FTP_SKIP_PASV_IP to 1L[1]. Note that these mitigations could cause problems in the uncommon instance that the server needs the client to connect back to an IP other than the control connection IP address.

1. <https://curl.se/libcurl/c/CURLOPT_FTP_SKIP_PASV_IP.html&gt;