Executive brief
A vulnerability in the design of the File Transfer Protocol (FTP) allows attackers to use an FTP server as an intermediary to send data to other systems. This can be used to bypass network security controls, scan internal networks, or launch attacks that appear to originate from the trusted FTP server rather than the attacker. This may lead to unauthorized access to internal services or the bypass of IP-based authentication.
Technical details
The vulnerability, known as an FTP bounce attack, stems from the design of the FTP 'PORT' command. An attacker can send a PORT command to an FTP server specifying the IP address and port of a third-party target machine rather than their own. When the attacker subsequently requests a file transfer, the FTP server attempts to open a data connection to the specified target. This allows the attacker to conduct port scanning or send unauthorized data to services on internal networks that are reachable by the FTP server but not directly by the attacker, effectively using the FTP server as a transparent proxy. Modern FTP server configurations typically mitigate this by restricting PORT commands to the IP address of the requesting client.
Affected products
- Generic FTP Server
Timeline
- 1997-12-10: disclosed: Initial publication date in NVD