libcurl SCP/SFTP Host Key Type Bypass via Callback

Executive Summary

This vulnerability occurs in libcurl versions 7.69.0 through 8.20.0 when performing SCP or SFTP transfers using the CURLOPT_SSH_KEYFUNCTION callback. If a server presents a host key type that does not match the one stored in the known_hosts file, the callback fails to reject this mismatch. As a result, the connection proceeds without warning, potentially allowing an attacker to perform a man-in-the-middle attack by impersonating the server.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow an attacker to intercept or alter data transferred between a client and server by exploiting the failure to properly validate the server's host key during SCP or SFTP transfers. This man-in-the-middle attack risk means sensitive data could be exposed or manipulated without the user's knowledge.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves improper host key validation during SCP or SFTP transfers when using the CURLOPT_SSH_KEYFUNCTION callback in libcurl with the libssh backend. Detection involves verifying if your libcurl version is between 7.69.0 and 8.20.0 and if it uses the libssh backend rather than libssh2.

To detect if your system is vulnerable, you can check the libcurl version installed and whether it is built with libssh. For example, run the following commands:

• Check libcurl version: `curl --version`
• Check linked SSH backend in libcurl output (look for 'libssh' or 'libssh2')

Additionally, monitoring network traffic for unexpected SSH host key mismatches during SCP or SFTP transfers could help detect exploitation attempts, but no specific detection commands are provided in the resources.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading libcurl to version 8.21.0 or later, where the vulnerability is fixed.

Alternatively, you can apply the official patch for this vulnerability or rebuild libcurl to use the libssh2 backend instead of libssh, as the issue only affects the libssh backend.

Users should avoid using vulnerable versions (7.69.0 through 8.20.0) with the libssh backend for SCP or SFTP transfers that utilize the CURLOPT_SSH_KEYFUNCTION callback.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a man-in-the-middle attack by silently accepting an untrusted server during SSH-based transfers, which could lead to unauthorized interception or modification of data in transit.

Such a security flaw may impact compliance with standards and regulations like GDPR and HIPAA, which require the protection of data confidentiality and integrity during transmission.

However, the provided information does not explicitly discuss or analyze the direct effects of this vulnerability on compliance with these or other common standards.

Useful 0 Not Useful 0