CVE-2014-8517: tnftp fetch_url command injection via HTTP redirect pipe

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote command execution with no attacker authentication and available exploit code, though it requires the victim to initiate the fetch and the affected software is dated.

What it is

The fetch_url function in tnftp's usr.bin/ftp/fetch.c mishandles a pipe character at the end of an HTTP redirect, allowing command injection. This affects tnftp as shipped in NetBSD 5.1 through 6.1.5 and related Apple products. Because the client is the vulnerable component, a malicious or compromised server can trigger command execution on the connecting host.

Impact

An attacker controlling the HTTP redirect target can execute arbitrary commands with the privileges of the user running tnftp, leading to full compromise of that account and any reachable data or credentials.

Attack surface

Reached over the network when a user or automated process runs tnftp against an attacker-influenced HTTP endpoint that returns a crafted redirect. No authentication is required on the attacker side, but the victim must initiate the fetch, so some user or scripted interaction is needed.

Exploitation

Not listed in CISA KEV, but EPSS is high at 0.691 (99.3rd percentile) and a public Exploit-DB entry (43112) exists, indicating exploit code is available. No ransomware association is documented.

What to do

• Apply the NetBSD-SA2014-013 patch or upgrade to a fixed tnftp/NetBSD release; apply the referenced Apple, openSUSE and Gentoo updates where applicable.
• Replace tnftp with a maintained HTTP client that does not pass redirect targets to a shell.
• Restrict outbound HTTP from hosts running tnftp to trusted destinations, and block redirects to untrusted hosts.
• Run tnftp as an unprivileged, isolated account with no access to sensitive files or credentials.
• Monitor and alert on tnftp invocations that follow redirects to external or unexpected hosts.

Detection

• Search process and shell logs for tnftp or ftp invocations followed by unexpected command execution or shell metacharacters.
• Inspect HTTP proxy or egress logs for redirects whose Location header ends in a pipe character or contains shell metacharacters.
• Alert on child processes spawned by tnftp that are not expected fetch-related binaries.
• Review endpoint telemetry for command lines containing '|' appended to URLs or redirect targets.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.