Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXI0bTUtNDdjcS02cWc4

Server-Side Request Forgery in ftp-srv

All versions of ftp-srv from v1.0.0 onward to v4.3.3 are vulnerable to Server-Side Request Forgery (SSRF). The package fails to prevent remote clients to access other resources in the network, for example when connecting to the server through telnet. This allows attackers to access any network resources available to the server, including private resources in the hosting environment.

Recommendation

Upgrade to patched versions
^2.19.6, ^3.1.2, ^4.3.4

Workarounds

Blacklisting the FTP Command PORT will prevent the server from exposing this behaviour through active connections until a fix is applied.

const ftp = new FtpSrv({
  blacklist: ['PORT']
});

Permalink: https://github.com/advisories/GHSA-r4m5-47cq-6qg8
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXI0bTUtNDdjcS02cWc4
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 3 years ago
Updated: 4 months ago

Identifiers: GHSA-r4m5-47cq-6qg8
References:

• https://www.npmjs.com/advisories/1445
• https://github.com/QuorumDMS/ftp-srv/security/advisories/GHSA-jw37-5gqr-cf9j
• https://github.com/advisories/GHSA-r4m5-47cq-6qg8

Repository: https://github.com/QuorumDMS/ftp-srv
Blast Radius: 0.0

Affected Packages