CVE-2020-8284: 
Splunk Forwarder vulnerability analysis and mitigation

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, potentially making curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions. The vulnerability was discovered by Varnavas Papaioannou and disclosed in December 2020 (Curl Docs).

When curl performs a passive FTP transfer, it first tries the EPSV command and if that is not supported, it falls back to using PASV. Passive mode is what curl uses by default. A server response to a PASV command includes the (IPv4) address and port number for the client to connect back to in order to perform the actual data transfer. This issue has existed in curl since the beginning of FTP support. The flaw only exists for IPv4 since PASV does not work for IPv6 and curl prefers EPSV (Curl Docs).

The vulnerability could allow a malicious server to make curl extract information about services that are otherwise private and not disclosed, enabling port scanning and service banner extractions. If curl operates on a URL provided by a user, this could be exploited without needing any server breach (Curl Docs).

The vulnerability has a CVSS Base Score of 3.7 (Low) with attack vector being Network, attack complexity High, requiring no privileges or user interaction (Debian Security). The passive mode setup is used for both uploads and downloads, making it exploitable in various FTP transfer scenarios (Curl Docs).

The issue was addressed by making CURLOPT_FTP_SKIP_PASV_IP default to 1L instead of previously being 0L, causing the IP address part of the response to be ignored by default. For cases where a server truly needs the client to connect back to a different IP address, CURLOPT_FTP_SKIP_PASV_IP can be set to 0L. For the command line tool, --no-ftp-skip-pasv-ip can be used. The fix was released in curl version 7.74.0 (Curl Docs).

The vulnerability was acknowledged and patched by multiple vendors including Apple, Oracle, Debian, and others. Firefox had previously fixed a similar issue in 2007 (CVE-2007-1562) (Curl Docs).