CVE-2020-15152: Server-Side Request Forgery in ftp-srv
Summary
CVE-2020-15152: Server-Side Request Forgery in ftp-srv. Affects ftp-srv across 3 version ranges.
>= 1.0.0, < 2.19.6
>= 3.0.0, < 3.1.2
>= 4.0.0, < 4.3.4
Fixed in 2.19.6, 3.1.2 or 4.3.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ftp-srv package is an npm package that provides an FTP server implementation in Node.js. It allows users to create an FTP server and handle FTP commands and data transfers. The package supports two methods for establishing the data connection: PASV (Passive) and PORT (Active). The vulnerability lies in the PORT command, which allows the client to specify an arbitrary IP address for the server to connect to. This can be exploited to cause the server to make unintended connections.
Vulnerability Detail
The vulnerability arises from the ability of the client to send an arbitrary IP address with the PORT command. By manipulating this IP address, an attacker can trick the server into making connections to unintended hosts. This can lead to various security issues, such as server-side request forgery (SSRF) attacks, where the server is coerced into making requests to internal or external resources on behalf of the attacker. The impact of this vulnerability can be severe, as it allows an attacker to bypass network restrictions and potentially access sensitive information or perform unauthorized actions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 2.19.62.19.6npm install ftp-srv@2.19.6 -
>= 3.0.0, < 3.1.23.1.2npm install ftp-srv@3.1.2 -
>= 4.0.0, < 4.3.44.3.4npm install ftp-srv@4.3.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating to the fixed version is not immediately feasible, a workaround is to blacklist the FTP command 'PORT' in the server configuration. This can be done by adding the 'blacklist' option when creating an instance of the FtpSrv class. Here is an example:
const ftp = new FtpSrv({
blacklist: ['PORT']
});
Conclusion
The ftp-srv package is vulnerable to a server-side request forgery (SSRF) issue due to the ability of the client to manipulate the FTP PORT command. This can lead to unauthorized access to sensitive information and potential security breaches. It is crucial to update to the fixed versions of the package or apply the provided workaround to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ftp-srv →
FAQ
The vulnerability allows an attacker to manipulate the FTP PORT command and make the server connect to unintended hosts. This can lead to server-side request forgery (SSRF) attacks and potential unauthorized access to sensitive information.
To fix this vulnerability, update the ftp-srv package to the fixed versions: 2.19.6, 3.1.2, or 4.3.4. These versions disallow PORT connections to alternate hosts.
Yes, if updating to the fixed version is not immediately possible, you can blacklist the FTP command 'PORT' in the server configuration. This prevents the server from exposing the vulnerability through active connections.
There is no known public exploitation of this vulnerability at the time of this advisory. However, it is important to address the vulnerability promptly to prevent potential security incidents.
The vulnerability was reported by @andreeleuterio to the npm platform, on behalf of an anonymous user named Vincent. It was fixed by @trs. @quiquelhappy also brought it to the attention of the package maintainers.
References
Related vulnerabilities
Recent vulnerabilities recorded for ftp-srv.
