CVE-2020-8284 Server-side request forgery in https://github.com/curl/curl
A malicious FTP server can trick curl into connecting to arbitrary internal IPs, enabling port scanning and service banner extraction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-8284?
CVE-2020-8284 is a low-severity server-side request forgery vulnerability in Apple Mac Os X, published on 14 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.
Weakness: CWE-200
Which versions are affected by CVE-2020-8284?
It affects 22 products.
Products include Apple Mac Os X, Apple Macos, Debian Debian Linux, Fedoraproject Fedora, Fujitsu M10-1 Firmware, Fujitsu M10-4 Firmware and 16 more.
How do I fix CVE-2020-8284?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2020-8284 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-8284 exists.
Other vulnerabilities in Apple Mac Os X
Sources
Also known as ALPINE-CVE-2020-8284, CLEANSTART-2026-FA34232, CLSA-2020-1608724009, CLSA-2021-1634922397, CLSA-2021-1634922414, CURL-CVE-2020-8284 and 4 more.