CVE-2021-22946

What it actually does

The flaw allows a malicious IMAP, POP3 or FTP server to return a crafted but valid response that bypasses curl's TLS upgrade requirement when --ssl-reqd or CURLOPT_USE_SSL is set to CURLUSESSL_CONTROL or CURLUSESSL_ALL, causing curl to silently continue the session in plaintext.

Why it matters to the business

Credentials, emails or files transferred with curl may travel unencrypted, enabling network eavesdroppers to capture sensitive information and increasing breach or compliance risk.

How an attack unfolds

An attacker hosts a rogue IMAP/POP3/FTP server that responds to curl's STARTTLS or AUTH TLS request with a legitimate-looking reply that omits the expected upgrade; curl accepts the reply, skips TLS negotiation and proceeds with clear-text commands, exposing all subsequent traffic.

How to fix it

Upgrade curl to a build containing commit 8e82f2a04a238c54ba91e553e9a8452e6d405965 or a later release that enforces the TLS requirement correctly.

How to confirm the fix worked

Confirm the running curl binary reports a version built after the referenced commit; re-test affected protocols with --ssl-reqd while capturing traffic to verify TLS negotiation occurs.

Typical attack path

1. Attacker deploys a malicious server answering on IMAP, POP3 or FTP ports
2. Victim invokes curl with --ssl-reqd or equivalent libcurl option against the attacker-controlled server
3. Server returns a crafted protocol response that satisfies curl's upgrade check without actually negotiating TLS
4. curl continues the session in plaintext
5. Attacker captures credentials, messages or files from the unencrypted stream

How to detect it

Search command-line logs, process execution records and network flow data for curl invocations that target IMAP, POP3 or FTP ports while requesting SSL; inspect packet captures for absence of TLS handshakes after such requests.

• curl.*--ssl-reqd.*(imap|pop3|ftp)://
• CURLOPT_USE_SSL.*CURLUSESSL_CONTROL.*without TLS
• STARTTLS.*response.*followed by plaintext LOGIN or RETR

What your security team should do

• Immediately update all curl installations to a fixed build
• Audit scripts, CI jobs and applications that use curl against IMAP, POP3 or FTP with SSL enforcement
• Add network monitoring rules to detect plaintext IMAP/POP3/FTP sessions originating from curl processes