Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Clients of FTP servers utilizing ftp-srv hosted on Windows machines can escape the FTP user's defined root folder using the expected FTP commands, for example, CWD and UPDR. Background When windows separators exist within the path (\), path.resolve leaves the upper pointers intact and allows the user to move beyond the root folder defined for that user. We did not take that into account when creating the path resolve function. Patches None at the moment. Workarounds There are no workarounds for windows servers. Hosting the server on a different OS mitigates the issue. References Issues: https://github.com/autovance/ftp-srv/issues/167 https://github.com/autovance/ftp-srv/issues/225 For more information If you have any questions or comments about this advisory: Open an issue at https://github.com/autovance/ftp-srv. Please email us directly; security@autovance.com.
Recommended action: Upgrade to 4.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
All versions of ftp-srv from v1.0.0 onward to v4.3.3 are vulnerable to Server-Side Request Forgery (SSRF). The package fails to prevent remote clients to access other resources in the network, for example when connecting to the server through telnet. This allows attackers to access any network resources available to the server, including private resources in the hosting environment. Recommendation Upgrade to patched versions ^2.19.6, ^3.1.2, ^4.3.4 Workarounds Blacklisting the FTP Command PORT will prevent the server from exposing this behaviour through active connections until a fix is applied.
Recommended action: Upgrade to 4.3.4, 3.1.2 or 2.19.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Background The FTP protocol creates two connections, one for commands and one for transferring data. This second data connection can be created in two ways, on the server by sending the PASV command, or on the client by sending the PORT command. The PORT command sends the IP and port for the server to connect to the client with. Issue Since the client can send an arbitrary IP with the PORT command, this can be used to cause the server to make a connection elsewhere. Patches fix: disallow PORT connections to alternate hosts: e449e75219d918c400dec65b4b0759f60476abca Deprecation notices have been published for older versions. Workarounds Blacklisting the FTP Command PORT will prevent the server from exposing this behaviour through active connections until a fix is applied. References https://www.npmjs.com/advisories/1445 Credits Thank you to; @trs for fixing it @andreeleuterio for reporting it to us for an anonymous user (Vincent) through the NPM platform @quiquelhappy for bringing it…
Recommended action: Upgrade to 4.3.4, 3.1.2 or 2.19.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.