CVE-2023-28321

What it actually does

A flaw in curl's handling of TELNET protocol responses allows a malicious server to inject arbitrary IAC command sequences during FTP passive mode negotiations, causing unintended control commands to be sent over the connection.

Why it matters to the business

Attackers can manipulate connections made by curl-based clients or tools, potentially leading to data exfiltration, command execution on affected systems, or disruption of automated transfers in scripts and applications that rely on curl for network operations. The high number of downstream dependents increases exposure across many environments.

How an attack unfolds

An attacker sets up a malicious FTP server that responds to PASV commands with crafted data containing TELNET IAC sequences. When a vulnerable curl client connects and negotiates the data channel, the injected commands are processed, allowing the attacker to influence the session behavior or exfiltrate information.

How to fix it

Upgrade curl to the version containing commit a9f8fe28481fef7c28d85b4a12a3a35521408eaf or later. Rebuild any dependent applications and libraries against the patched version. Disable TELNET or FTP features if unused.

How to confirm the fix worked

Verify the installed curl binary or library reports a version built after commit a9f8fe28481fef7c28d85b4a12a3a35521408eaf. Test FTP passive transfers against a server sending IAC sequences and confirm no unexpected commands are executed.

Typical attack path

1. Attacker hosts a malicious FTP server responding to PASV with IAC-injected payloads
2. Victim application or script uses vulnerable curl to connect to the attacker-controlled server
3. curl processes the crafted response and injects TELNET commands into the control channel
4. Attacker observes or influences the resulting session to achieve objectives such as data theft or further compromise

How to detect it

Inspect network logs and application traces for FTP sessions involving unexpected TELNET IAC byte sequences (0xFF followed by command bytes) in PASV responses. Correlate with curl process executions connecting to untrusted endpoints.

• IAC byte sequences (0xFF) embedded in FTP 227 responses
• curl process connecting to attacker-controlled FTP servers during data channel setup

What your security team should do

• Prioritize patching all curl instances to the fixed commit within the next 30 days due to public exploit availability
• Scan source code and dependency manifests for direct or transitive use of vulnerable curl versions
• Update build pipelines and container images to enforce the patched curl version
• Review and restrict use of FTP/TELNET protocols in production workloads where possible