Is CVE-2020-26299 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-26299 being exploited in the wild.

How severe is CVE-2020-26299?

Informational severity, published 10 February 2021.

Which products and versions are affected?

ftp-srv (npm) SEMVER:introduced=0,fixed=4.4.0.

Is there a fix for CVE-2020-26299?

Yes. ftp-srv (npm): upgrade to 4.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-26299 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-26299?

Check whether you run ftp-srv (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-26299: Autovance ftp-srv directory traversal on Windows

CVE-2020-26299 · Severity: info · Published 2021-02-10

ftp-srv is a Node.js FTP server implementation used to provide file transfer services. On Windows systems, attackers can use standard FTP commands to escape the confined directory that an FTP user is restricted to, potentially gaining access to files outside their authorized scope.

Technologies: ftp-srv (npm). Vendors: npm.

Quick answers

Is CVE-2020-26299 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-26299 being exploited in the wild.
How severe is CVE-2020-26299?: Informational severity, published 10 February 2021.
Which products and versions are affected?: ftp-srv (npm) SEMVER:introduced=0,fixed=4.4.0.
Is there a fix for CVE-2020-26299?: Yes. ftp-srv (npm): upgrade to 4.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-26299 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-26299?: Check whether you run ftp-srv (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ftp-srv (npm): upgrade to 4.4.0 or later
```
npm install ftp-srv@4.4.0
```

Technical details

This is a path traversal vulnerability (CWE-22) affecting ftp-srv's path resolution logic on Windows. The root cause is improper handling of Windows path separators (\) in the path.resolve function; when backslashes are present, path pointers (\..) are left intact, allowing an authenticated FTP client to navigate beyond the configured root folder using standard FTP commands like CWD (Change Working Directory) and CDUP (Change to Parent Directory). The vulnerability is specific to Windows-based servers and requires a valid FTP connection. Attackers can read or modify files outside their assigned directory. The vulnerability was addressed in version 4.4.0, but patches for earlier versions were not released.

Affected products

Autovance ftp-srv <= 4.3.4

Identifiers

CVE-2020-26299
GHSA-pmw4-jgxx-pcq9

Timeline

2020-12-16: disclosed
2021-02-10: advisory
4.4.0: patched

References

https://github.com/autovance/ftp-srv/security/advisories/GHSA-pmw4-jgxx-pcq9

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.