Server-Side Request Forgery in ftp-srv
Summary
GHSA-r4m5-47cq-6qg8: Server-Side Request Forgery in ftp-srv. Affects ftp-srv across 3 version ranges.
>= 1.0.0, < 2.19.6
>= 3.0.0, < 3.1.2
>= 4.0.0, < 4.3.4
Fixed in 2.19.6, 3.1.2 or 4.3.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The ftp-srv package is an npm package that provides a server implementation of the FTP protocol. It allows users to create FTP servers and handle client requests. The package is widely used for FTP server functionality in various applications.
Vulnerability Detail
The ftp-srv package is vulnerable to Server-Side Request Forgery (SSRF). This vulnerability allows remote clients to access other resources in the network, even when connecting to the server through telnet. Attackers can exploit this vulnerability to access any network resources available to the server, including private resources in the hosting environment. The impact of this vulnerability can be severe, as it compromises the security and confidentiality of the server's network.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 2.19.62.19.6npm install ftp-srv@2.19.6 -
>= 3.0.0, < 3.1.23.1.2npm install ftp-srv@3.1.2 -
>= 4.0.0, < 4.3.44.3.4npm install ftp-srv@4.3.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As there is no fix available, there is no specific workaround provided for this vulnerability. However, users can mitigate the risk by implementing additional security measures such as network segmentation, access controls, and monitoring to detect and prevent unauthorized access to network resources.
Conclusion
The ftp-srv package is vulnerable to Server-Side Request Forgery (SSRF), which allows remote clients to access other network resources. Currently, there is no fix available for this vulnerability. It is recommended to use an alternative package and implement additional security measures to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ftp-srv →
FAQ
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to make requests from the server to other resources in the network. This can be used to access sensitive information or perform actions on behalf of the server.
The vulnerability in ftp-srv allows remote clients to access other resources in the network, including private resources in the hosting environment. This can lead to unauthorized access, data breaches, and potential compromise of the entire network.
Currently, there is no fix available for this vulnerability in the ftp-srv package. It is recommended to use an alternative package until a fix is made available.
While there is no specific workaround provided, users can mitigate the risk by implementing additional security measures such as network segmentation, access controls, and monitoring to detect and prevent unauthorized access to network resources.
For more information about this vulnerability, you can refer to the GitHub Advisory Database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-r4m5-47cq-6qg8/GHSA-r4m5-47cq-6qg8.json
References
Related vulnerabilities
Recent vulnerabilities recorded for ftp-srv.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
