curl / Docs / Security Problems / Metalink download sends credentials

Metalink download sends credentials

Project curl Security Advisory, July 21th 2021 - Permalink

VULNERABILITY

When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.

We are not aware of any exploit of this flaw.

INFO

This flaw exists only in the curl tool. libcurl is not affected.

This flaw has existed in curl since commit b5fdbe848bc3d in curl 7.27.0, released on July 27, 2012.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2021-22923 to this issue.

CWE-522: Insufficiently Protected Credentials

Severity: Medium

AFFECTED VERSIONS

THE SOLUTION

curl has completely removed the metalink feature as of 7.78.0. No fix for this flaw will be produced by the curl project.

The fix for earlier versions is to rebuild curl with the metalink support switched off!

RECOMMENDATIONS

A - Upgrade curl to version 7.78.0

B - Make sure you do not use metalink with curl

C - Disable metalink in your build

TIMELINE

This issue was reported to the curl project on May 30, 2021.

This advisory was posted on Jul 21, 2021.

CREDITS

This issue was reported by Harry Sintonen. Patched by Daniel Stenberg.

Thanks a lot!