CVE-2021-22890

Vulnerability

When libcurl (built with OpenSSL or a fork) uses an HTTPS proxy with TLS 1.3, it can confuse session tickets arriving from the proxy with those from the remote server. This flaw affects curl versions 7.63.0 through 7.75.0 and does not occur with TLS 1.2 or earlier. The code, not updated for TLS 1.3's post-handshake ticket delivery, mistakenly short-cuts the host handshake using the proxy's ticket. [1]

Exploitation

An attacker must operate an HTTPS proxy that provides a TLS certificate the curl client will accept for the target server (or the client must have disabled certificate verification). During a TLS 1.3 session, the proxy sends its session ticket; libcurl treats it as if it came from the remote server, skipping proper certificate validation. No user interaction beyond normal traffic is required. [1]

Impact

A malicious HTTPS proxy can perform a man-in-the-middle (MITM) attack on the connection, intercepting or modifying traffic without the client detecting the breach. This compromises confidentiality and integrity of all data exchanged through the proxy. The attack achieves the trust level of the proxy's certificate, but if verification is ignored, any proxy can succeed. [1]

Mitigation

Curl version 7.76.0 and later fix the issue. For affected versions, the only workaround is to disable TLS 1.3 or avoid using TLS 1.3 with HTTPS proxies until upgrading is possible. [1] The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.