CVE-2020-26299: File System Bounds Escape in ftp-srv
Summary
CVE-2020-26299: File System Bounds Escape. Affects ftp-srv versions < 4.4.0. Fixed in 4.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ftp-srv is an npm package that provides an FTP server implementation. It allows clients to connect to the server and perform various FTP operations. The package is commonly used on Windows machines to host FTP servers. However, a vulnerability has been discovered in the package that allows clients to escape the FTP user's defined root folder using certain FTP commands. This vulnerability can be exploited when the path contains Windows separators (\). The path.resolve function used in the package does not properly handle these separators, allowing users to move beyond the root folder and access unauthorized files or directories.
Vulnerability Detail
The vulnerability in ftp-srv allows clients to bypass the root folder restrictions and access files or directories outside of their authorized scope. This can lead to unauthorized access to sensitive information or the execution of arbitrary code. The issue arises from the improper handling of Windows separators in the path.resolve function. When these separators exist in the path, the upper pointers are not properly resolved, allowing users to navigate beyond the root folder. This vulnerability affects Windows machines hosting FTP servers using ftp-srv.
How To Fix
Minimum fixed version
4.4.0
This is the first release that contains the fix.
npm install ftp-srv@4.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no workarounds available specifically for Windows servers hosting ftp-srv. However, one possible mitigation is to host the FTP server on a different operating system that is not affected by this vulnerability.
Conclusion
The vulnerability in ftp-srv allows clients to escape the FTP user's defined root folder and access unauthorized files or directories. This can lead to unauthorized access to sensitive information or the execution of arbitrary code. To fix this vulnerability, users should update their installation of ftp-srv to version 4.4.0 or later. Hosting the FTP server on a different operating system can also mitigate the issue. For more information and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ftp-srv →
FAQ
The impact of this vulnerability is that clients can escape the FTP user's defined root folder and access unauthorized files or directories on the server.
To fix this vulnerability, you need to update your installation of ftp-srv to version 4.4.0 or later.
There are no specific workarounds available for Windows servers hosting ftp-srv. However, hosting the FTP server on a different operating system can mitigate the issue.
There are no known public exploits for this vulnerability at the moment.
For more information, you can visit the GitHub issues related to this vulnerability: https://github.com/autovance/ftp-srv/issues/167 and https://github.com/autovance/ftp-srv/issues/225. You can also open an issue on the ftp-srv GitHub repository or contact the maintainers directly at security@autovance.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for ftp-srv.
