curl / Docs / curl CVEs / Metalink download sends credentials
Awarded 700 USD

CVE-2021-22923

Metalink download sends credentials

Project curl Security Advisory, July 21th 2021 - Permalink

VULNERABILITY

When curl is instructed to get content using the Metalink feature, and a user name and password are used to download the Metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.

INFO

This flaw exists only in the curl tool. libcurl is not affected.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2021-22923 to this issue.

CWE-522: Insufficiently Protected Credentials

Severity: Medium

AFFECTED VERSIONS

SOLUTION

curl has completely removed the Metalink feature as of 7.78.0. No fix for this flaw will be produced by the curl project.

The fix for earlier versions is to rebuild curl with the Metalink support switched off!

RECOMMENDATIONS

A - Upgrade curl to version 7.78.0

B - Make sure you do not use Metalink with curl

C - Disable Metalink in your build

TIMELINE

This issue was reported to the curl project on May 30, 2021.

This advisory was posted on Jul 21, 2021.

CREDITS

Thanks a lot!