# CVE-2020-15152: ftp-srv server-side request forgery via PORT command

Source: https://junglewise.ai/threats/cve-2020-15152-ftp-srv-server-side-request-forgery-via-port-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-08-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2020-15152 · Severity: low · CVSS 3.1 · Published 2020-08-17

ftp-srv is a Node.js library that implements FTP (File Transfer Protocol) server functionality. A server-side request forgery vulnerability allows remote attackers to exploit the PORT command to force the FTP server to make arbitrary network connections to attacker-specified hosts and ports, potentially enabling access to internal network resources or amplification of attacks against third parties.

Technologies: [ftp-srv (npm)](https://junglewise.ai/threats/technologies/ftp-srv). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2020-15152 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-15152 being exploited in the wild.

**How severe is CVE-2020-15152?** Low severity, with a CVSS score of 3.1, published 17 August 2020.

**Which products and versions are affected?** ftp-srv (npm) SEMVER:introduced=1.0.0,fixed=2.19.6.

**Is there a fix for CVE-2020-15152?** Yes. ftp-srv (npm): upgrade to 2.19.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-15152 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2020-15152?** Check whether you run ftp-srv (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ftp-srv (npm): upgrade to 2.19.6 or later

  ```sh
  npm install ftp-srv@2.19.6
  ```


## Technical details

The vulnerability exists in ftp-srv's handling of the FTP PORT command, which is used to negotiate active-mode data connections. The PORT command allows a client to specify an arbitrary IP address and port, but ftp-srv did not validate that the destination was the originating client—allowing an attacker to specify any target address. This enables server-side request forgery (SSRF), where the server makes outbound connections to attacker-controlled destinations. The vulnerability affects all versions from 1.0.0 to 4.3.3 across multiple release branches (1.x, 2.x, 3.x, 4.x). A patch restricting PORT connections to the originating client address is available in versions 2.19.6, 3.1.2, and 4.3.4+. No authentication is required to trigger this vulnerability; any FTP client can execute the attack over the network.

## Affected products

- Autovance ftp-srv <2.19.6, <3.1.2, <4.3.4

## Identifiers

- CVE-2020-15152
- GHSA-jw37-5gqr-cf9j

## Timeline

- 2020-08-17: disclosed

## References

- [https://github.com/autovance/ftp-srv/security/advisories/GHSA-jw37-5gqr-cf9j](https://github.com/autovance/ftp-srv/security/advisories/GHSA-jw37-5gqr-cf9j)

## Related threats

- [Autovance ftp-srv directory traversal on Windows](https://junglewise.ai/threats/cve-2020-26299-autovance-ftp-srv-directory-traversal-on-windows)
- [ftp-srv server-side request forgery in PORT command](https://junglewise.ai/threats/ftp-srv-server-side-request-forgery-in-port-command-a072646c)