# CVE-2020-8284: trusting FTP PASV responses

curl trusts attacker-controlled FTP PASV IP/port, letting a malicious FTP server make curl port-scan internal hosts and leak service banners via SSRF.

- Payout: hidden
- Severity: low
- Program: curl
- Found by: vepe
- Disclosed: 2021-02-09
- CVE: CVE-2020-8284
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1040166
- Library page: https://bugbountylibrary.com/r/h1%3A1040166
- Tags: area:devices domain:network impact:internal-access kind:bounty platform:hackerone sev:low tech:curl technique:recon vuln:info-disclosure vuln:ssrf

**Target:** curl FTP client (PASV data channel)
**Root cause:** CURLOPT_FTP_SKIP_PASV_IP is disabled by default, so curl connects to the IP/port supplied in the FTP server's PASV response instead of reusing the control connection's peer address.
**Steps:**
1. Set up a malicious FTP server that returns an arbitrary target IP/port in the PASV response.
2. Trigger curl (e.g. via an SSRF in a web app) against the attacker's FTP URL.
3. Observe timing/behavior: open port -> curl sends `TYPE I` after PASV; filtered -> timeout after PASV; closed -> control channel closes immediately after PASV.
4. Enumerate internal hosts/ports and read banners (e.g. SSH version) returned through the data channel.
**How found:** Noticed curl's default CURLOPT_FTP_SKIP_PASV_IP disabled means PASV-provided IP/port is honored; built a custom FTP server to control the PASV response and observed distinct timing/behavior per port state.
**Exploitation:** Attacker controls the FTP URL fetched by a curl-using app (e.g. SSRF). The malicious FTP server replies to PASV with the internal target IP/port; curl connects there, and the response timing/behavior distinguishes open/closed/filtered ports, enabling internal port scanning and banner disclosure.
**Escalation:** Use discovered internal services as a stepping stone for further attacks; version enumeration via banners.
**Insight:** When auditing SSRF sinks, check whether the client honors server-supplied addresses in protocol responses (FTP PASV, EPSV) rather than pinning to the control peer; timing differences after a protocol command can leak port state even without response bodies.