Unauthorized Directory Listing Vulnerability in python-pyftpdlib (CVE-2009-5012)
Summary
CVE-2009-5012: ftpserver.py in pyftpdlib before 0.5.2 does not require the l permission for the MLST command, which allows remote authenticated users to bypass intended access restrictions and list the root directory via an FTP session... Affects python-pyftpdlib versions < 0.5.2-1. Fixed in 0.5.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-pyftpdlib is a popular library for implementing FTP servers in Python. It provides a flexible and easy-to-use interface for creating FTP servers, allowing developers to customize their functionality. However, prior to version 0.5.2, it contained a vulnerability that allowed authenticated users to bypass access restrictions, potentially exposing sensitive directory listings.
Vulnerability Detail
The vulnerability identified as CVE-2009-5012 arises from the ftpserver.py component of pyftpdlib versions before 0.5.2. It does not enforce the necessary 'l' permission for the MLST command, which is intended to restrict directory listings. As a result, remote authenticated users can exploit this flaw to list the contents of the root directory, leading to unauthorized access to sensitive information. This vulnerability poses significant risks, especially in environments where sensitive data is stored and access controls are critical.
How To Fix
Minimum fixed version
0.5.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-pyftpdlibTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, a temporary workaround is to restrict access to the FTP server by implementing stricter user permissions and limiting the commands available to authenticated users. This can help mitigate the risk of unauthorized directory listing until the package can be updated.
Conclusion
The CVE-2009-5012 vulnerability in python-pyftpdlib poses a significant risk by allowing authenticated users to list sensitive directories. Upgrading to version 0.5.2-1 or later is crucial for securing your FTP server. Until then, implementing stricter access controls can help mitigate the risk.
See every vulnerability recorded for python-pyftpdlib →
FAQ
CVE-2009-5012 is a vulnerability in the python-pyftpdlib library that allows authenticated users to bypass access restrictions and list the root directory.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The primary risk is unauthorized access to sensitive directory listings, which could lead to data exposure and potential exploitation by malicious users.
Yes, you can implement stricter user permissions and limit the commands available to authenticated users as a temporary workaround.
If immediate upgrading is not possible, ensure that your FTP server is configured with strict access controls and monitor for any suspicious activity.
Related vulnerabilities
Recent vulnerabilities recorded for python-pyftpdlib.
