Executive brief
ftp-srv is a popular Node.js FTP server library used to provide file transfer services. An attacker connecting to an affected server can exploit the PORT command to trick the server into making outbound connections to arbitrary network hosts, potentially allowing unauthorized access to internal resources, cloud metadata services, or other network-accessible systems.
Technical details
The vulnerability is a Server-Side Request Forgery (CWE-918) in the FTP protocol implementation. When a client sends the FTP PORT command, it specifies an IP address and port where the server should establish a data connection. ftp-srv versions 1.0.0 through 4.3.3 failed to validate that the supplied IP address matches the client's own address, allowing an unauthenticated remote attacker to force the server to connect to arbitrary hosts on the network. This enables access to internal resources unavailable from the attacker's location, including private cloud metadata endpoints. The fix restricts PORT connections to only the client's own IP address. Patches are available in versions 2.19.6, 3.1.2, and 4.3.4 and later.
Affected products
- QuorumDMS ftp-srv 1.0.0 through 4.3.3 (fixed in 2.19.6, 3.1.2, 4.3.4+)
Timeline
- 2020-08-31: disclosed: Security advisory GHSA-jw37-5gqr-cf9j published
- 2020-09-04: advisory: GHSA-r4m5-47cq-6qg8 published to GitHub Advisory Database