# ftp-srv server-side request forgery in PORT command

Source: https://junglewise.ai/threats/ftp-srv-server-side-request-forgery-in-port-command-a072646c  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-09-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · CVSS 7.5 · Published 2020-09-04

ftp-srv is a popular Node.js FTP server library used to provide file transfer services. An attacker connecting to an affected server can exploit the PORT command to trick the server into making outbound connections to arbitrary network hosts, potentially allowing unauthorized access to internal resources, cloud metadata services, or other network-accessible systems.

Technologies: [ftp-srv (npm)](https://junglewise.ai/threats/technologies/ftp-srv). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, with a CVSS score of 7.5, published 4 September 2020.

**Which products and versions are affected?** ftp-srv (npm) SEMVER:introduced=1.0.0,fixed=2.19.6.

**Is there a fix for This vulnerability?** Yes. ftp-srv (npm): upgrade to 2.19.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run ftp-srv (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ftp-srv (npm): upgrade to 2.19.6 or later

  ```sh
  npm install ftp-srv@2.19.6
  ```


## Technical details

The vulnerability is a Server-Side Request Forgery (CWE-918) in the FTP protocol implementation. When a client sends the FTP PORT command, it specifies an IP address and port where the server should establish a data connection. ftp-srv versions 1.0.0 through 4.3.3 failed to validate that the supplied IP address matches the client's own address, allowing an unauthenticated remote attacker to force the server to connect to arbitrary hosts on the network. This enables access to internal resources unavailable from the attacker's location, including private cloud metadata endpoints. The fix restricts PORT connections to only the client's own IP address. Patches are available in versions 2.19.6, 3.1.2, and 4.3.4 and later.

## Affected products

- QuorumDMS ftp-srv 1.0.0 through 4.3.3 (fixed in 2.19.6, 3.1.2, 4.3.4+)

## Timeline

- 2020-08-31: disclosed: Security advisory GHSA-jw37-5gqr-cf9j published
- 2020-09-04: advisory: GHSA-r4m5-47cq-6qg8 published to GitHub Advisory Database

## References

- [https://github.com/QuorumDMS/ftp-srv/security/advisories/GHSA-jw37-5gqr-cf9j](https://github.com/QuorumDMS/ftp-srv/security/advisories/GHSA-jw37-5gqr-cf9j)
- [https://github.com/QuorumDMS/ftp-srv](https://github.com/QuorumDMS/ftp-srv)

## Related threats

- [Autovance ftp-srv directory traversal on Windows](https://junglewise.ai/threats/cve-2020-26299-autovance-ftp-srv-directory-traversal-on-windows)
- [ftp-srv server-side request forgery via PORT command](https://junglewise.ai/threats/cve-2020-15152-ftp-srv-server-side-request-forgery-via-port-command)