patrickjuchli basic-ftp CRLF injection in login and MKD commands

Executive brief

A vulnerability in the basic-ftp library allows attackers to execute unauthorized commands on an FTP server. By providing specially crafted usernames, passwords, or directory names containing hidden line-break characters, an attacker can trick the system into performing unintended actions like deleting files or changing permissions. This is particularly critical because it can occur even before a user has successfully logged in, potentially granting unauthorized access to the server's file system.

Technical details

The basic-ftp library fails to properly sanitize control characters (CRLF) in two specific code paths, leading to command injection. First, the 'login()' method directly concatenates user-supplied credentials into USER and PASS commands without validation. Second, the '_openDir()' method sends an MKD command before performing whitespace validation, creating a TOCTOU (time-of-check to time-of-use) bypass. An attacker can exploit these by injecting '\r\n' followed by arbitrary FTP commands (e.g., DELE, RMD, SITE) into input fields. This vulnerability is fixed in version 5.2.2.

Affected products

• patrickjuchli basic-ftp <= 5.2.1

Timeline

• 2026-04-09: patched: Version 5.2.2 released
• 2026-04-10: advisory: GitHub Advisory GHSA-6v7q-wjvx-w8wg published

References

• https://api.github.com/users/offset
• https://github.com/offset
• https://api.github.com/users/offset/gists%7B/gist_id%7D
• https://api.github.com/users/offset/repos
• https://avatars.githubusercontent.com/u/114768995?v=4
• https://api.github.com/users/offset/events%7B/privacy%7D