Is CVE-2020-15152 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-15152 being exploited in the wild.

How severe is CVE-2020-15152?

Low severity, with a CVSS score of 3.1, published 17 August 2020.

Which products and versions are affected?

ftp-srv (npm) SEMVER:introduced=1.0.0,fixed=2.19.6.

Is there a fix for CVE-2020-15152?

Yes. ftp-srv (npm): upgrade to 2.19.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-15152 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-15152?

Check whether you run ftp-srv (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-15152: ftp-srv server-side request forgery via PORT command

CVE-2020-15152 · Severity: low · CVSS 3.1 · Published 2020-08-17

ftp-srv is a Node.js library that implements FTP (File Transfer Protocol) server functionality. A server-side request forgery vulnerability allows remote attackers to exploit the PORT command to force the FTP server to make arbitrary network connections to attacker-specified hosts and ports, potentially enabling access to internal network resources or amplification of attacks against third parties.

Technologies: ftp-srv (npm). Vendors: npm.

Quick answers

Is CVE-2020-15152 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-15152 being exploited in the wild.
How severe is CVE-2020-15152?: Low severity, with a CVSS score of 3.1, published 17 August 2020.
Which products and versions are affected?: ftp-srv (npm) SEMVER:introduced=1.0.0,fixed=2.19.6.
Is there a fix for CVE-2020-15152?: Yes. ftp-srv (npm): upgrade to 2.19.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-15152 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-15152?: Check whether you run ftp-srv (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ftp-srv (npm): upgrade to 2.19.6 or later
```
npm install ftp-srv@2.19.6
```

Technical details

The vulnerability exists in ftp-srv's handling of the FTP PORT command, which is used to negotiate active-mode data connections. The PORT command allows a client to specify an arbitrary IP address and port, but ftp-srv did not validate that the destination was the originating client—allowing an attacker to specify any target address. This enables server-side request forgery (SSRF), where the server makes outbound connections to attacker-controlled destinations. The vulnerability affects all versions from 1.0.0 to 4.3.3 across multiple release branches (1.x, 2.x, 3.x, 4.x). A patch restricting PORT connections to the originating client address is available in versions 2.19.6, 3.1.2, and 4.3.4+. No authentication is required to trigger this vulnerability; any FTP client can execute the attack over the network.

Affected products

Autovance ftp-srv <2.19.6, <3.1.2, <4.3.4

Identifiers

CVE-2020-15152
GHSA-jw37-5gqr-cf9j

Timeline

2020-08-17: disclosed

References

https://github.com/autovance/ftp-srv/security/advisories/GHSA-jw37-5gqr-cf9j

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.