Executive brief
ftp-srv is a Node.js library that implements FTP (File Transfer Protocol) server functionality. A server-side request forgery vulnerability allows remote attackers to exploit the PORT command to force the FTP server to make arbitrary network connections to attacker-specified hosts and ports, potentially enabling access to internal network resources or amplification of attacks against third parties.
Technical details
The vulnerability exists in ftp-srv's handling of the FTP PORT command, which is used to negotiate active-mode data connections. The PORT command allows a client to specify an arbitrary IP address and port, but ftp-srv did not validate that the destination was the originating client—allowing an attacker to specify any target address. This enables server-side request forgery (SSRF), where the server makes outbound connections to attacker-controlled destinations. The vulnerability affects all versions from 1.0.0 to 4.3.3 across multiple release branches (1.x, 2.x, 3.x, 4.x). A patch restricting PORT connections to the originating client address is available in versions 2.19.6, 3.1.2, and 4.3.4+. No authentication is required to trigger this vulnerability; any FTP client can execute the attack over the network.
Affected products
- Autovance ftp-srv <2.19.6, <3.1.2, <4.3.4
Timeline
- 2020-08-17: disclosed