CVE-2009-5012: pyftpdlib FTP Server MLST Command Bypass
Summary
CVE-2009-5012: ftpserver.py in pyftpdlib before 0.5.2 does not require the l permission for the MLST command, which allows remote authenticated users to bypass intended access restrictions and list the root directory via an FTP session... Affects pyftpdlib versions < 0.5.2. Fixed in 0.5.2. How to fix ↓
Also tracked for
- python-pyftpdlib · Debian:11
The same CVE-2009-5012 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyftpdlib is a Python FTP server library that provides a high-level interface for implementing FTP servers. It allows developers to create custom FTP servers with various features and functionalities. However, versions before 0.5.2 are vulnerable to an access restriction bypass.
Vulnerability Detail
The vulnerability (CVE-2009-5012) in pyftpdlib arises from the FTP server not properly enforcing access restrictions for the MLST command. This oversight allows remote authenticated users to bypass intended access restrictions and list the root directory via an FTP session. By exploiting this vulnerability, an attacker with valid credentials can gain unauthorized access to sensitive files and directories on the server.
How To Fix
Minimum fixed version
0.5.2
This is the first release that contains the fix.
pip install --upgrade "pyftpdlib==0.5.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update pyftpdlib to the fixed version as soon as possible.
Conclusion
The vulnerability in pyftpdlib allows authenticated users to bypass access restrictions and list the root directory. To mitigate this issue, it is crucial to update pyftpdlib to version 0.5.2 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyftpdlib →
FAQ
pyftpdlib is a Python FTP server library that allows developers to create custom FTP servers.
This vulnerability allows authenticated users to bypass access restrictions and list the root directory, potentially exposing sensitive files and directories on the server.
To fix this vulnerability, upgrade pyftpdlib to version 0.5.2 or later.
No, there is no known workaround for this vulnerability. Updating to the fixed version is the recommended solution.
You can find more information about this vulnerability in the pyftpdlib advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/pyftpdlib/PYSEC-2010-9.yaml
Related vulnerabilities
Recent vulnerabilities recorded for pyftpdlib.
