Horizon Alert
Summary of the vulnerability and why it matters
This advisory addresses a security flaw in the libcurl library related to how it handles FTP connections, specifically when transferring files without secure TLS encryption. The issue allows a previously authenticated connection to be reused incorrectly, potentially enabling unauthorized access under a prior identity. The main concern is confirming relevance and exposure due to the specific configuration required for this vulnerability to be exploitable.
- Reused connections enable improper access.
- Affects specific, non-default FTP configurations.
- Confirm if your systems use these settings.
Attack Path
How an attacker could exploit the issue
An attacker could exploit this vulnerability by initiating an FTP transfer using specific, insecure configurations. If a previous connection was established with TLS and client certificate authentication, a subsequent connection without these security measures could improperly reuse the authenticated session. This allows the attacker to impersonate the legitimate user and potentially access or modify sensitive data.
- Network exposure, no privileges needed.
- Reusing authenticated FTP control connection.
- Unauthorized data access or modification.
Live Threat
Current exploitation, exposure, and threat context
When an FTP client reuses a pooled control connection after a STARTTLS upgrade and client certificate authentication, a subsequent transfer without a new TLS handshake or login may be authorized under the previous authenticated identity. This could affect sensitive information or system data when the FTP server is configured to permit such connection reuse with specific `CURLUSESSL_NONE` settings.
- Server credentials and data could be exposed.
- Reused connection bypasses authentication checks.
- Unauthorized data access or modification.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability impacts applications using libcurl for FTP transfers under specific, non-default configurations involving `CURLUSESSL_NONE` and `STARTTLS`. Identifying affected systems involves locating applications that handle FTP connections with these settings, assessing their reachability and business criticality, and then assigning ownership for remediation. The first practical step is to confirm the deployment of the affected technology and identify its accountable owner to plan risk-based remediation.
- Application owners should manage the issue.
- Verify unpatched, reachable systems first.
- Plan remediation based on exposure and criticality.
