Executive brief
ftp-srv is a Node.js FTP server implementation used to provide file transfer services. On Windows systems, attackers can use standard FTP commands to escape the confined directory that an FTP user is restricted to, potentially gaining access to files outside their authorized scope.
Technical details
This is a path traversal vulnerability (CWE-22) affecting ftp-srv's path resolution logic on Windows. The root cause is improper handling of Windows path separators (\) in the path.resolve function; when backslashes are present, path pointers (\..) are left intact, allowing an authenticated FTP client to navigate beyond the configured root folder using standard FTP commands like CWD (Change Working Directory) and CDUP (Change to Parent Directory). The vulnerability is specific to Windows-based servers and requires a valid FTP connection. Attackers can read or modify files outside their assigned directory. The vulnerability was addressed in version 4.4.0, but patches for earlier versions were not released.
Affected products
- Autovance ftp-srv <= 4.3.4
Timeline
- 2020-12-16: disclosed
- 2021-02-10: advisory
- 4.4.0: patched